Senior SOC L3 / CSIRT Incident Response Coordinator

OKATIM Iberica SA; Brussel; Hybrid; EUR 110,000 - 140,000; Full time

Job summary

OKATIM Iberica SA is seeking a highly experienced Senior SOC L3 / CSIRT Incident Response Coordinator to join a challenging cybersecurity project in Brussels. The role combines advanced incident response with operational leadership across IT and OT environments.

You will lead end-to-end incident response, act as the top escalation point, coordinate multiple teams, and continually improve security operations and playbooks.

Qualifications

• Ten+ years in cybersecurity operations and incident response.
• Experience at SOC Level 3 (L3) handling advanced threats and escalation.
• Proven ability to lead teams and coordinate across SOC/CSIRT.
• Mandatory OT/ICS cybersecurity experience.
• Strong incident response methodologies, threat detection, containment, remediation and recovery.

Responsibilities

• Lead and coordinate end-to-end cybersecurity incident response activities from triage to post-incident review.
• Act as the highest technical escalation point (SOC Level 3) for in-depth investigations.
• Coordinate SOC analysts, incident response teams, IT/OT specialists and external stakeholders during incidents.
• Provide technical leadership and support effective team management during critical incidents.
• Develop, maintain and improve incident response procedures, playbooks and processes.
• Coordinate threat analysis, remediation and follow-up activities.
• Support cybersecurity operations in OT/ICS environments considering continuity and availability.
• Monitor performance, produce reports and drive SOC/CSIRT maturity improvements.
• Collaborate with engineering to enhance SIEM/EDR detection capabilities.
• Organise and participate in cybersecurity exercises and lessons-learned sessions.

Skills

SOC Level 3

Incident response

OT/ICS security

Team leadership

Threat investigations

Coordination

English fluency

French/Dutch

Security operations

Job description

We are looking for a highly experienced Senior SOC L3 / CSIRT Incident Response Coordinator to join a challenging cybersecurity project within a critical infrastructure environment in Brussels.

This position combines advanced technical expertise in cybersecurity incident response with operational leadership, cross-functional coordination and continuous improvement of security operations.

You will play a key role in managing complex cybersecurity incidents across IT and Operational Technology (OT) environments, ensuring effective collaboration between SOC teams, technical specialists and business stakeholders.

Key Responsibilities

• Lead and coordinate end-to-end cybersecurity incident response activities, from initial triage and investigation through containment, eradication, recovery and post-incident review.
• Act as the highest technical escalation point (SOC Level 3), conducting in-depth investigations and assessing security threats and their operational impact.
• Coordinate SOC analysts, incident response teams, IT/OT specialists and external stakeholders during security incidents.
• Provide technical leadership and support effective team management during critical incidents.
• Develop, maintain and continuously improve incident response procedures, playbooks and operational processes.
• Coordinate threat analysis, vulnerability remediation and incident follow-up activities.
• Support cybersecurity operations in OT/ICS environments, taking into account operational continuity and availability requirements.
• Monitor incident response performance, produce structured reports and contribute to continuous SOC/CSIRT maturity improvements.
• Collaborate with engineering teams to enhance SIEM/EDR detection capabilities, monitoring coverage and security use cases.
• Organise and participate in cybersecurity exercises, incident simulations and lessons-learned activities.

Required Qualifications & Experience

• Minimum 10 years of professional experience, with substantial experience in cybersecurity operations and incident response.
• Proven hands‑on experience in SOC Level 3 (L3) activities, including advanced threat investigation and incident escalation.
• Demonstrated experience in team management and operational coordination within SOC, CSIRT or cybersecurity incident response environments.
• Mandatory experience in Operational Technology (OT/ICS) cybersecurity.
• Strong understanding of incident response methodologies, threat detection, containment, remediation and recovery.
• Solid technical knowledge of enterprise cybersecurity, network security, identity and access management, logging and security monitoring.
• Ability to coordinate multiple technical teams and stakeholders under pressure.
• Strong analytical, problem‑solving, communication and documentation skills.
• Fluent English and professional proficiency in French or Dutch.

Nice to Have

• Experience in the defence, railway or critical infrastructure sectors.
• Knowledge of Microsoft security technologies, including Microsoft Defender and Entra ID, or equivalent enterprise security solutions.
• Familiarity with SIEM, EDR, threat hunting and digital forensics.
• Knowledge of NIST incident response practices and MITRE ATT&CK.
• Experience with Azure DevOps, security use case management and SOC process improvement.
• Professional proficiency in both French and Dutch.
• Relevant cybersecurity certifications such as GCIH, GCFA, CISSP or equivalent.

What We Offer

An opportunity to contribute to a long‑term cybersecurity mission within a complex, business‑critical infrastructure environment.

You will work alongside experienced cybersecurity professionals, combining advanced technical incident response with operational leadership and continuous security improvement.

The position is open to both freelance professionals and candidates seeking permanent employment, with a hybrid working arrangement in Brussels.

Interested?

If you have a strong background in SOC L3 operations, hands‑on incident response, team leadership and OT cybersecurity, we'd love to hear from you.