Incident Response Team Lead: Crisis & Client Engagement

Check-Point-Software-Technologies-2; Madrid; On-site; EUR 70,000 - 100,000; Full time

Job summary

Check Point Software Technologies in Madrid is seeking an experienced Incident Response Team Leader to guide a group of IR analysts during enterprise security incidents across EMEA. This hands-on leadership role focuses on threat containment, investigations, and delivering timely executive briefings.

You will coordinate triage, containment, eradication, and recovery, while improving processes, tooling, and collaboration with security teams.

Qualifications

• 5+ years of experience in Incident Response, or DFIR.
• Strong knowledge of ransomware, cloud, identity, and enterprise attack investigations.
• Excellent customer-facing communication and stakeholder management skills.
• Experience leading remote teams in high-pressure environments.
• Proficient with EDR, SIEM, threat intelligence, and forensic investigation tools.
• GIAC, GCFA, GCIH, CISSP, or similar certifications.

Responsibilities

• Lead and mentor a team of Incident Response analysts during active security incidents
• Serve as the primary customer-facing lead during investigations and crisis situations
• Coordinate incident triage, containment, eradication, and recovery efforts
• Deliver executive-level communications, incident briefings, and post-incident reporting
• Drive operational readiness, process improvement, and collaboration across security teams

Skills

Incident Response

DFIR

EDR

SIEM

Threat intel

Forensic tools

Tools

Forensic investigation tools

Job description

Check Point Software Technologies in Madrid is seeking an experienced Incident Response Team Leader to guide a group of IR analysts during enterprise security incidents across EMEA. This hands-on leadership role focuses on threat containment, investigations, and delivering timely executive briefings.

You will coordinate triage, containment, eradication, and recovery, while improving processes, tooling, and collaboration with security teams.