Security Operations & Incident Response Analyst

Aleph; Madrid; Presencial; EUR 43.000 - 53.000; Jornada completa

Descripción de la vacante

Aleph is seeking an experienced Security Operations & Incident Response Analyst (L3) to join its global IT Security team. You will be the first line of defence when incidents occur, owning end‑to‑end response, threat hunting, and governance across a globally distributed environment.

You will coordinate with Legal, Privacy, HR, and external SOC/MDR providers, maintain incident playbooks, manage vulnerability and IAM programs, and communicate findings to stakeholders.

Formación

• 3–5 years in a SOC/incident response security operations role, with at least 1–2 years at L3 level is a plus.
• Experience implementing or managing IAM and PAM solutions.
• Experience in international or multinational environments.
• Hands‑on experience with incident response engagements (internal or consulting).
• Relevant certifications: GCIH, GCFE, GCFA, CEH, CompTIA CySA+, or equivalent. OSCP is a plus.

Responsabilidades

• Own and coordinate the end-to-end incident response process: identification, triage, containment, eradication, recovery, post-incident review.
• Lead data breach investigations: scope breach, evidence, exposure, and coordinate with Legal/Privacy/HR.
• Conduct proactive threat hunting using threat intelligence and IoCs.
• Manage vulnerability management: scans across infra, endpoints, and cloud; prioritize and coordinate remediation.
• Oversee IAM periodic access reviews and PAM governance; investigate identity-related anomalies.

Conocimientos

SIEM expertise

EDR/XDR experience

Threat hunting

Incident response

IAM and PAM

MITRE ATT&CK

Vulnerability scanning

Digital forensics

Documentation

Multinational experience

Educación

GCIH, GCFE, GCFA, CEH, CompTIA CySA+

OSCP or equivalent (nice to have)

Herramientas

SIEM platforms

EDR/XDR tools

Tenable Nessus

Qualys

Rapid7

CyberArk

BeyondTrust

Azure PIM

MISP threat intel

Descripción del empleo

Are you ready to join our digital revolution journey?

At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.

Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.

With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career.

We are looking for an experienced and operationally sharp Security Operations & Incident Response Analyst (L3) to join Aleph's global IT Security team.

Reporting to the Global CISO, you will be the first line of defence when incidents occur and the engine behind the team's threat detection and response capabilities. You will own the end‑to‑end incident response process, lead threat hunting and intelligence activities, and manage the vulnerability and identity governance programmes — ensuring Aleph is both able to detect threats quickly and respond to them effectively across a complex, globally distributed environment.

Incident Response

• Own and coordinate the end-to-end incident response process: identification, triage, containment, eradication, recovery, and post-incident review (lessons learned).
• Serve as the primary point of contact for security incidents escalated from IT Operations, the Security Engineer, and external sources.
• Maintain and continuously improve incident response playbooks for the most relevant threat scenarios (ransomware, phishing, account compromise, data breach, insider threat, etc.).
• Manage the security incident log and register: track all incidents, document timelines and actions, and produce trend analysis and reporting for the CISO.
• Coordinate with external SOC or MDR providers where applicable: review daily reports, validate alert quality, and manage escalation workflows.

Data Breach Management

• Lead data breach investigations: scope the breach, gather and preserve evidence, assess PII exposure, and coordinate response with Legal, Privacy, and HR.
• Produce breach investigation reports with findings, root cause, and recommendations.

Threat Hunting & Intelligence

• Conduct proactive threat hunting across the environment: develop hypotheses based on threat intelligence, search for indicators of compromise (IoCs), and investigate anomalous behaviour.
• Manage the Threat Intelligence function: track relevant threat actors, TTPs (MITRE ATT&CK), and sector‑specific threat campaigns; integrate intelligence into SIEM/XDR detection rules and hunting queries.
• Produce threat intelligence summaries and briefings for the CISO and relevant stakeholders.

Vulnerability Management

• Own the vulnerability management programme: schedule and execute periodic vulnerability scans across infrastructure, endpoints, and cloud environments.
• Analyse scan results, prioritise findings by risk and exploitability, and coordinate remediation with IT Operations within agreed SLAs.
• Track remediation progress, produce vulnerability metrics, and report status to the CISO.
• Validate remediation effectiveness through re‑scanning and spot‑checks.

Identity & Access Management (IAM)

• Manage periodic access reviews: coordinate with system owners and HR to review and certify user permissions across critical systems, ensuring least privilege is maintained.
• Oversee the Privileged Access Management (PAM) programme: define PAM policies, monitor privileged account usage, and review access rights for administrator-level accounts.
• Investigate and respond to identity‑related anomalies and access policy violations.

• 3–5 years in a SOC analyst, incident response, or security operations role, with at least 1–2 years at L3 level is a plus.
• Experience implementing or managing IAM and PAM solutions
• Experience working within international or multinational environments.
• Hands‑on experience with incident response engagements (internal or consulting) is strongly valued.
• Relevant certifications: GCIH, GCFE, GCFA, CEH, CompTIA CySA+, or equivalent. OSCP is a plus.
• Strong hands‑on experience with SIEM platforms (alert triage, rule writing, query development) and EDR/XDR tools.
• Solid knowledge of the MITRE ATT&CK framework and its application to threat hunting and incident response.
• Experience conducting vulnerability scans using tools such as Tenable Nessus, Qualys, Rapid7, or similar.
• Familiarity with IAM and PAM concepts and platforms (e.g. CyberArk, BeyondTrust, Azure PIM, or equivalent).
• Experience with digital forensics and incident response (DFIR) methodologies: evidence collection, log analysis, and timeline reconstruction.
• Knowledge of threat intelligence platforms and feeds (e.g. MISP, VirusTotal, threat intel feeds).
• Understanding of ISO 27001 incident management controls, NIS2 incident reporting obligations, and PCI DSS requirement 12.10.
• Calm and decisive under pressure.
• Strong investigative mindset with structured problem‑solving approach, excellent documentation skills.
• Ability to communicate incident status and findings clearly to both technical teams and executive stakeholders.
• Collaborative and proactive, comfortable working asynchronously across time zones.
• English: full professional proficiency (C1/C2) — primary working language. Spanish: professional proficiency is a plus.

In line with the EU Pay Transparency Directive, we are committed to fair and open compensation practices. For this role, the minimum gross annual base salary is EUR 48,000 EUR.

In addition to base salary, this role includes a variable component, paid annually. The final offer will reflect your experience, skills, and the scope of the role.

#Aleph

Why Join Us?

Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever‑changing industry, our curiosity keeps us learning and seeking out new opportunities.

We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.

#ALEPH