Senior SOC L3 / CSIRT Incident Response Coordinator

OKATIM Iberica SA; Brussel; Hybrid; EUR 90,000 - 130,000; Full time

Job summary

OKATIM Iberica SA in Brussels is seeking a highly experienced Senior SOC L3 / CSIRT Incident Response Coordinator to lead and coordinate complex cybersecurity incidents across IT and OT environments. You will act as the top technical escalation point, manage cross-functional teams, and drive continuous improvement of incident response playbooks and security operations.

The role requires a minimum of 10 years in cybersecurity operations, hands-on SOC L3 experience, and mandatory OT/ICS expertise.

Qualifications

• 10+ years of experience in cybersecurity operations and incident response.
• Proven SOC Level 3 activities with advanced threat investigation and incident escalation.
• Experience in team management and operational coordination within SOC/CSIRT environments.
• Mandatory OT/ICS cybersecurity experience.
• Fluent English with professional proficiency in French or Dutch.

Responsibilities

• Lead end-to-end cybersecurity incident response activities from triage to post-incident review.
• Act as the highest technical escalation point (SOC Level 3) for investigations and threat assessments.
• Coordinate SOC analysts, incident response teams, OT/IT specialists and external stakeholders during incidents.
• Provide technical leadership and support effective team management during critical incidents.
• Develop and improve incident response playbooks and operational processes.
• Coordinate threat analysis, vulnerability remediation and incident follow-ups.
• Support OT/ICS cybersecurity operations prioritizing continuity and availability.
• Monitor performance, report on incidents and contribute to SOC maturity.
• Collaborate with engineering teams to enhance SIEM/EDR detection and use cases.
• Organize cybersecurity exercises and lessons-learned sessions.

Skills

SOC L3

Incident response

Team leadership

Threat detection

OT security

Tools

SIEM

EDR

Azure DevOps

Job description

We are looking for a highly experienced Senior SOC L3 / CSIRT Incident Response Coordinator to join a challenging cybersecurity project within a critical infrastructure environment in Brussels.

This position combines advanced technical expertise in cybersecurity incident response with operational leadership, cross-functional coordination and continuous improvement of security operations.

You will play a key role in managing complex cybersecurity incidents across IT and Operational Technology (OT) environments, ensuring effective collaboration between SOC teams, technical specialists and business stakeholders.

Key Responsibilities

• Lead and coordinate end-to-end cybersecurity incident response activities, from initial triage and investigation through containment, eradication, recovery and post-incident review.
• Act as the highest technical escalation point (SOC Level 3), conducting in-depth investigations and assessing security threats and their operational impact.
• Coordinate SOC analysts, incident response teams, IT/OT specialists and external stakeholders during security incidents.
• Provide technical leadership and support effective team management during critical incidents.
• Develop, maintain and continuously improve incident response procedures, playbooks and operational processes.
• Coordinate threat analysis, vulnerability remediation and incident follow-up activities.
• Support cybersecurity operations in OT/ICS environments, taking into account operational continuity and availability requirements.
• Monitor incident response performance, produce structured reports and contribute to continuous SOC/CSIRT maturity improvements.
• Collaborate with engineering teams to enhance SIEM/EDR detection capabilities, monitoring coverage and security use cases.
• Organise and participate in cybersecurity exercises, incident simulations and lessons-learned activities.

Required Qualifications & Experience

• Minimum 10 years of professional experience, with substantial experience in cybersecurity operations and incident response.
• Proven hands‑on experience in SOC Level 3 (L3) activities, including advanced threat investigation and incident escalation.
• Demonstrated experience in team management and operational coordination within SOC, CSIRT or cybersecurity incident response environments.
• Mandatory experience in Operational Technology (OT/ICS) cybersecurity.
• Strong understanding of incident response methodologies, threat detection, containment, remediation and recovery.
• Solid technical knowledge of enterprise cybersecurity, network security, identity and access management, logging and security monitoring.
• Ability to coordinate multiple technical teams and stakeholders under pressure.
• Strong analytical, problem‑solving, communication and documentation skills.
• Fluent English and professional proficiency in French or Dutch.

Nice to Have

• Experience in the defence, railway or critical infrastructure sectors.
• Knowledge of Microsoft security technologies, including Microsoft Defender and Entra ID, or equivalent enterprise security solutions.
• Familiarity with SIEM, EDR, threat hunting and digital forensics.
• Knowledge of NIST incident response practices and MITRE ATT&CK.
• Experience with Azure DevOps, security use case management and SOC process improvement.
• Professional proficiency in both French and Dutch.
• Relevant cybersecurity certifications such as GCIH, GCFA, CISSP or equivalent.

What We Offer

An opportunity to contribute to a long‑term cybersecurity mission within a complex, business‑critical infrastructure environment.

You will work alongside experienced cybersecurity professionals, combining advanced technical incident response with operational leadership and continuous security improvement.

The position is open to both freelance professionals and candidates seeking permanent employment, with a hybrid working arrangement in Brussels.

Interested?

If you have a strong background in SOC L3 operations, hands‑on incident response, team leadership and OT cybersecurity, we'd love to hear from you.