Cybersecurity Incident Response Engineer

Schneider Electric; Barcelona; Hybrid; EUR 50,000 - 85,000; Full time

Benefits offered by this job

Hybrid work plan

Floating holidays

Sabbatical pack

Global family leave policy

Job summary

Schneider Electric is seeking a Cybersecurity Incident Response Engineer in Barcelona to lead the end-to-end handling of security incidents within a regional scope. You will validate alerts, coordinate containment and recovery actions, and ensure timely escalation for complex events.

Join a global digital security team, collaborating with SOC, infrastructure, and risk leaders across the organization while maintaining thorough case documentation and standardized playbooks.

Qualifications

• 2-4 years of professional experience in cybersecurity operations, incident response, SOC operations, or related discipline.
• Hands-on experience investigating security events and coordinating technical response actions.
• Technical background in computer science, information technology, cybersecurity, or related discipline.
• English proficiency (spoken and written).

Responsibilities

• Lead end-to-end incident response lifecycle for regional cybersecurity incidents.
• Validate alerts, determine scope, coordinate containment and recovery actions.
• Escalate high-priority or cross-regional incidents to senior responders.
• Maintain clear communication with stakeholders in English.

Skills

Cybersecurity

Incident Response

SOC operations

English proficiency

Technical analysis

Education

Bachelor's degree in CS/IT

Tools

SIEM

EDR

KQL

Cloud security monitoring

Job description

We are your Energy Technology Partner. We electrify, automate, and digitalize every industry, business, and home, driving efficiency and sustainability for all.

At Schneider Electric, our values – IMPACT (Inclusion, Mastery, Purpose, Action, Curiosity, Teamwork) – are the foundation of everything we do. Becoming an Impact Maker means turning sustainability ambitions into actions at the intersection of automation, electrification, and digitization.

Are you ready to lead the digital transformation to create a more sustainable world?

If you are up to challenge your creativity and make an impact, we are excited to welcome you!

Schneider Digital is the digital department of Schneider Electric, leading the digital transformation in the company by giving support globally to our internal teams and our clients. Schneider Digital consists of 6 Digital Hubs worldwide which are strategically located to ensure a 24/7 support across the company (France, China, India, USA, Mexico and Spain). Our Digital Hub in Barcelona is formed by +450 employees working in strategic projects and different roles such as Data, Cybersecurity, ERP, Cloud, Infrastructures, IT Project Management or Digital Marketing.

We are looking for a Cybersecurity Incident Response Engineer to join the Enterprise IT Infrastructure Security team in Barcelona. The role focuses on cybersecurity incident response and supports the consistent handling of incidents impacting Enterprise IT.

The successful candidate will independently manage security incidents within the assigned regional scope, following established incident response processes and playbooks. The role requires sound technical analysis, disciplined case management, effective coordination with operational teams, and timely escalation when an incident exceeds the assigned scope or severity.

Role Mission

• Execute the end-to-end incident response lifecycle for assigned cybersecurity incidents within one region.
• Validate alerts, determine incident scope and impact, coordinate containment and recovery actions, and document conclusions and evidence.
• Apply approved playbooks and procedures consistently, adapting case tasks when required while escalating high-priority, global, or highly complex incidents to senior responders or incident owners.
• Maintain clear communication with technical teams, regional cybersecurity stakeholders, and affected business contacts throughout the investigation.

What will you do?

Key Responsibilities

Incident Triage and Investigation

• Review security alerts and reported events to determine whether they represent a cybersecurity incident.
• Assess severity, affected assets, users, business scope, and potential impact using established classification criteria.
• Collect and analyze relevant evidence, including SIEM events, endpoint telemetry, identity and sign-in data, email artefacts, network logs, cloud activity, and indicators of compromise.
• Develop and document an investigation timeline, working hypotheses, findings, and technical conclusions.
• Escalate promptly when evidence indicates high impact, cross-regional scope, legal or privacy implications, or the need for specialist forensic analysis.

Containment, Eradication and Recovery

• Coordinate containment actions with SOC, endpoint, identity, messaging, network, cloud, infrastructure, and application teams.
• Use approved playbooks and response procedures to reduce exposure while preserving relevant evidence.
• Track assigned remediation and recovery actions through completion and validate that agreed technical measures have been implemented.

Case Management and Communication

• Maintain accurate and timely case records, including actions taken, evidence reviewed, decisions, owners, and status updates.
• Provide clear technical summaries for both technical and non-technical stakeholders in English.
• Coordinate with regional Digital Risk Leaders, CISOs, SOC, Cyber Defense, Infrastructure, Identity, Forensics, Threat Intelligence, Privacy, and other teams as required by the case.
• Participate in handovers and operational reviews to support continuity of response across time zones.
• Contribute factual input to post-incident reviews and lessons learned. Ownership of process redesign or strategic improvement initiatives is not a core expectation of this role.

Detection and Technical Enablement

• Use SIEM, EDR, identity, network, cloud, email security, and case-management tools to investigate incidents.
• Create or adapt basic hunting queries and scripts to collect, normalize, correlate, or summarize investigative data.
• Use approved automation and AI-assisted capabilities to improve the speed and consistency of analysis and reporting, under established governance and review controls.
• Share recurring operational observations with senior responders and detection or engineering teams for further assessment.

What qualifications will make you successful?

Experience and Education

Required

• 2-4 years of professional experience in cybersecurity operations, incident response, SOC operations, infrastructure security, or a closely related discipline.
• Hands-on experience investigating security events and coordinating technical response actions in an enterprise IT environment.
• Technical background in computer science, information technology, cybersecurity, engineering, or a related discipline, or equivalent practical experience.
• Ability to manage assigned incidents with limited supervision while recognizing escalation thresholds and decision boundaries.
• Working proficiency in English, both written and spoken.

Preferred

• Experience with Microsoft security technologies, KQL, endpoint detection and response, cloud security monitoring, or identity investigation.
• Exposure to case management, forensic triage, vulnerability management, threat intelligence, or phishing and account-compromise investigations.
• Experience with scripting, data analysis, APIs, or automation workflows.
• Relevant certifications such as GCIH, GCFA, Security+, SC-200, or equivalent are an advantage but are not mandatory.

Soft Skills and Behaviors

• Structured, methodical, and accountable in case handling and evidence documentation.
• Able to remain calm, prioritize effectively, and make sound operational decisions during time-sensitive situations.
• Clear communicator who can explain technical findings and required actions to different audiences.
• Collaborative team member who works effectively across regions, functions, and technical domains.
• Curious and analytical, with a willingness to learn from incidents and develop broader technical expertise.
• Careful with confidential information and committed to ethical evidence handling.
• Comfortable receiving guidance from senior responders and escalating when a case exceeds the role scope.

Desired Technical Skills

• Incident Response
• Intermediate
• Practical knowledge of triage, analysis, containment, eradication, recovery, evidence gathering, escalation, and case closure.
• Incident Response Tools
• Intermediate
• Ability to use tools for incident detection, investigation, response coordination, forensic triage, and indicator analysis.
• Security Monitoring / SIEM
• Intermediate
• Ability to investigate alerts, correlate events, build basic queries, and reconstruct incident timelines.
• Endpoint Security / EDR
• Intermediate
• Ability to interpret endpoint alerts, process activity, persistence indicators, and host containment actions.
• Identity and Access Security
• Beginner to Intermediate
• Understanding of account compromise, MFA abuse, privileged access, suspicious sign-ins, and session or token risks.
• Network Security
• Beginner to Intermediate
• Understanding of network protocols, firewalls, proxies, IDS/IPS, WAF, DNS, and network evidence used during investigations.
• Windows Administration
• Intermediate
• Ability to understand Windows environments, users, services, processes, event logs, and common security artefacts.
• Linux Administration
• Intermediate
• Understanding of Linux operating-system concepts, logs, permissions, services, and command-line usage.
• Cloud Security: Azure / AWS
• Beginner
• Understanding of cloud concepts, audit logs, identity controls, and common security services in Azure and AWS.
• Vulnerability Management
• Beginner to Intermediate
• Ability to understand vulnerability impact, exploitability, affected scope, remediation status, and risk-based prioritization.
• Threat IntelligenceBeginner
• Ability to interpret threat reporting and indicators in support of a specific investigation.
• Digital Forensics
• Beginner
• Understanding of evidence preservation, artefact review, chain of custody, and criteria for specialist escalation.
• Coding and Automation
• Beginner
• Ability to use Python, PowerShell, Bash, KQL, APIs, or similar tools for repeatable investigation and reporting tasks.
• AI-Assisted Security Operations
• Beginner
• Understanding of controlled use of AI tools for summarization, enrichment, and repetitive analytical tasks.

What's in it for me?

We adapt to you:

• With our flexible schedule, you'll have the freedom to adjust your work hours to accommodate your personal needs and responsibilities.
• We know how great it is to work from home. With our hybrid work plan, you can enjoy working from the comfort of your home.
• Need more time to relax and disconnect? With our Holy Pack, you can purchase additional vacation days to recharge when you need it most.
• Celebrate holidays your way! With Floating Holidays, you can exchange holidays for other days that better suit your plans and personal preferences.
• Need additional time to explore new experiences or focus on personal projects? With the Sabbatical Pack, you can request up to 2 months of extra leave (unpaid).
• We value the importance of family and want to support you in all aspects of your life. Our Global Family Leave Policy provides flexible paid conditions for when you need it most, whether you're about to be a parent, need time to overcome a loss, or to care for a loved one.

We take care of you:

• With access to the health and wellness platform Wellwo, you and up to 5 people of your choice can enjoy access to wellness content, nutrition counseling, fitness classes, and more!
• From dance classes to booking a hotel spa, we offer an agreement with Wellhub so