Incident Manager

Auxis; Bogotá; On-site; COP 180,000,000 - 300,000,000; Full time

Job summary

Grant Thornton's Cyber Fusion Centre (CFC) is seeking an experienced CSIRT Incident Responder / Threat Hunter to protect enterprise systems by promptly responding to security threats. You will act as the incident response orchestrator, managing major escalations from the SOC and coordinating across teams.

You will lead threat hunting across platforms, analyze malware and PCAPs, and drive post-incident reports and corrective actions.

Qualifications

• 6+ years in cybersecurity, SOC operations, or threat hunting.
• 2+ years in Major Incident Management (MIM) in 24x7 CSIRT/MSSP or enterprise.
• Experience handling endpoint security incidents (malware, credential theft, lateral movement).
• Familiarity with MITRE ATT&CK and incident response lifecycle.
• Bachelor's degree in CS/Cybersecurity or equivalent practical incident response experience.

Responsibilities

• Act as lead incident response orchestrator during active security events.
• Proactively hunt threats across cross-platform security tooling and analyze samples/PCAPs.
• Oversee end-to-end incident lifecycle, including containment and root cause analysis.
• Maintain real-time incident timelines and brief stakeholders on MIM calls.
• Recommend SIEM and playbook improvements to strengthen detections and response.

Skills

SOC operations

Threat hunting

MIM leadership

MITRE ATT&CK

Education

Bachelor's degree in CS/Cybersecurity

Tools

CrowdStrike Falcon

SOAR orchestration

Job description

Grant Thornton's Cyber Fusion Centre (CFC) is looking for an experienced CSIRT Incident Responder / Threat Hunter to protect enterprise systems by promptly responding to security threats. Acting as the incident response orchestrator, you will manage major escalations from the SOC, proactively hunt for threats, and collaborate across technical and business stakeholders to maintain the organization's robust security posture.

What You Will Do

• Major Incident Orchestration: Act as the lead incident response orchestrator during active security events. Launch Major Incident Management (MIM) bridges, assign containment actions, and coordinate cross-functional teams (SOC, Infrastructure, IAM, Legal, Privacy, etc.).
• Advanced Threat Hunting & Analysis: Proactively hunt for threats across cross-platform security tooling. Perform static/dynamic analysis on malware samples and PCAPs to extract network Indicators of Compromise (IOCs).
• End-to-End Incident Lifecycle: Monitor CSIRT trigger channels, validate business impact and severity, guide forensic evidence preservation, oversee short- and long-term containment, and conduct root cause analysis.
• Stakeholder Communication: Maintain real-time incident timelines, brief executive and technical stakeholders on MIM calls, and produce thorough post-incident reports and corrective action plans.
• Continuous Improvement: Recommend SIEM detection enhancements, fine-tune alerts, improve response playbooks, and identify and mitigate vulnerabilities and attack paths.

What You Bring

• Experience: 6+ years in cybersecurity, SOC operations, or threat hunting, coupled with 2+ years of dedicated experience in Major Incident Management (MIM) within a 24x7 CSIRT/MSSP or enterprise environment.
• Technical Proficiency: Deep expertise handling endpoint security incidents (e.g., malware infections, credential theft, lateral movement, persistence). Experience with CrowdStrike Falcon Next-Gen SIEM/EDR and SOAR orchestration is highly preferred.
• Analytical Skills: Solid understanding of the MITRE ATT&CK framework and the incident response lifecycle. Proven ability to make calm, structured decisions under high-pressure scenarios.
• Education: Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or equivalent practical incident response experience.
• Certifications (Preferred): GIAC Certified Incident Handler (GCIH), CrowdStrike Certified Falcon Responder (CCFR), or CrowdStrike Certified Falcon Hunter (CCFH).

Ready to lead the response against advanced cyber threats?