Lead CSIRT Incident Commander & Threat Hunter

Auxis; Bogotá; On-site; COP 180,000,000 - 300,000,000; Full time

Job summary

Grant Thornton's Cyber Fusion Centre (CFC) is seeking an experienced CSIRT Incident Responder / Threat Hunter to protect enterprise systems by promptly responding to security threats. You will act as the incident response orchestrator, managing major escalations from the SOC and coordinating across teams.

You will lead threat hunting across platforms, analyze malware and PCAPs, and drive post-incident reports and corrective actions.

Qualifications

• 6+ years in cybersecurity, SOC operations, or threat hunting.
• 2+ years in Major Incident Management (MIM) in 24x7 CSIRT/MSSP or enterprise.
• Experience handling endpoint security incidents (malware, credential theft, lateral movement).
• Familiarity with MITRE ATT&CK and incident response lifecycle.
• Bachelor's degree in CS/Cybersecurity or equivalent practical incident response experience.

Responsibilities

• Act as lead incident response orchestrator during active security events.
• Proactively hunt threats across cross-platform security tooling and analyze samples/PCAPs.
• Oversee end-to-end incident lifecycle, including containment and root cause analysis.
• Maintain real-time incident timelines and brief stakeholders on MIM calls.
• Recommend SIEM and playbook improvements to strengthen detections and response.

Skills

SOC operations

Threat hunting

MIM leadership

MITRE ATT&CK

Education

Bachelor's degree in CS/Cybersecurity

Tools

CrowdStrike Falcon

SOAR orchestration

Job description

Grant Thornton's Cyber Fusion Centre (CFC) is seeking an experienced CSIRT Incident Responder / Threat Hunter to protect enterprise systems by promptly responding to security threats. You will act as the incident response orchestrator, managing major escalations from the SOC and coordinating across teams.

You will lead threat hunting across platforms, analyze malware and PCAPs, and drive post-incident reports and corrective actions.