Cyber Security Operations & Incident Response Specialist

Bain & Company; Ciudad de México; Híbrido; MXN 450.000 - 700.000; Jornada completa

Descripción de la vacante

Bain & Company is seeking a Security Operations Analyst to safeguard digital assets and data. You will monitor threats, respond to incidents, and help improve security controls across the firm in a hybrid, fast-paced environment.

You'll work across Security Monitoring, Incident Detection and Response, Threat Intel, and related disciplines, with opportunities to specialize; strong English and collaboration skills are essential.

Formación

• Bachelor's degree in CS, cybersecurity, IT, or equivalent.
• 3-5+ years in Security Operations, Incident Response, or related field.
• Professional proficiency in English.
• Hands-on with SIEM platforms and EDR solutions as listed.
• Experience with enterprise security tech including firewalls, IDS/IPS, SIEM, EDR, antivirus, CASB, and DLP.
• Familiarity with NIST, ISO 27001, CIS Controls, or CSA.

Responsabilidades

• Monitor security systems, logs, and alerts to identify incidents.
• Administer and optimize SIEM, IDS/IPS, firewalls, EDR, antivirus, and DLP.
• Research threats and incident techniques, incorporating intelligence into work.
• Investigate security events and assess severity and impact.
• Run incident response playbooks and report on metrics and trends.
• Collaborate with cross-functional teams to strengthen security posture.

Conocimientos

Security Operations

Incident Response

English proficiency

Analytical skills

Cross-functional collaboration

Educación

Bachelor's degree in Computer Science/Cybersecurity/IT or equivalent

Herramientas

Splunk

XSIAM/XSOAR

CrowdStrike

Microsoft Defender

Firewalls

IDS/IPS

DLP

CASB

Descripción del empleo

We are proud to be consistently recognized as one of the world's best places to work. We are currently the top ranked consulting firm on Glassdoor’s Best Places to Work list and have earned the #1 overall spot a record seven times. Extraordinary teams are at the heart of our business strategy, but these don’t happen by chance. They require intentional focus on bringing together a broad set of backgrounds, cultures, experiences, perspectives, and skills in a supportive and inclusive work environment. We hire people with exceptional talent and create an environment in which every individual can thrive professionally and personally.

WHO YOU'LL WORK WITH

You’ll join our Enterprise Technology team, part of Bain’s digital capabilities practice. In this multidisciplinary group, you’ll help modernize our technology strategy, architecture, and systems - aligning technology with business goals to drive efficiency, agility, and innovation. You’ll collaborate with Cyber Operations, Infrastructure, and Technology teams to strengthen Bain’s security posture and support resilient, secure operations across the firm.

WHERE YOU'LL FIT WITHIN THE TEAM

As a Security Operations Analyst within Bain’s Cyber Operations team, you'll help safeguard the firm's digital assets, systems, and data. You'll monitor, analyze, and respond to cybersecurity threats while supporting the implementation and continuous improvement of security controls that align with regulatory requirements and industry best practices.

Depending on business priorities and your experience, you'll contribute across multiple Security Operations disciplines—including Security Monitoring, Incident Detection and Response, Threat Intelligence, Vulnerability Management, and Proactive Security Testing—or develop deeper expertise within a specialized area.

WHAT YOU'LL DO

Security Monitoring (40%)

• Continuously monitor security systems, logs, and alerts to identify potential security incidents and vulnerabilities.
• Administer and optimize security technologies including SIEM platforms, IDS/IPS, firewalls, endpoint detection and response (EDR), antivirus, and data loss prevention (DLP) solutions.
• Research emerging cyber threats, vulnerabilities, and attack techniques, incorporating relevant intelligence into monitoring and detection activities.
• Help improve the effectiveness of monitoring capabilities through ongoing tuning and process enhancements.
• Investigate and analyze security events, including malware, unauthorized access attempts, suspicious activity, and potential data breaches.
• Assess incident severity and business impact, escalating and responding appropriately.
• Execute and continuously improve incident response playbooks to contain threats and restore normal operations.
• Produce regular and ad hoc reporting on security incidents, trends, vulnerabilities, and operational metrics.
• Validate that security controls are operating effectively and remain aligned with internal security policies and standards.
• Collaborate with cross-functional teams to resolve incidents and strengthen the firm's overall security posture.

Professional Development & Continuous Improvement (10%)

• Stay current on evolving cybersecurity technologies, threats, and industry best practices.
• Contribute to automation, process optimization, and operational improvements across the Security Operations function.
• Pursue relevant technical training and professional certifications in partnership with leadership.
• Share knowledge and collaborate with colleagues across Cyber Operations, Enterprise Technology, and business teams.

ABOUT YOU

You're a curious, collaborative cybersecurity professional who enjoys solving complex problems and continuously improving security operations in a fast-paced, global environment.

Required qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field, or an equivalent combination of education, training, and experience.
• 3-5+ years of experience in Security Operations, Incident Response, or a related cybersecurity function.
• Professional proficiency in English.
• Hands-on experience with SIEM platforms (such as Splunk or Palo Alto XSIAM/XSOAR) and endpoint detection and response (EDR) solutions including CrowdStrike, Microsoft Defender, or similar technologies.
• Experience working with enterprise security technologies including firewalls, IDS/IPS, SIEM, EDR, antivirus, CASB, and DLP solutions.
• Experience investigating and responding to cybersecurity incidents.
• Familiarity with security frameworks such as NIST, ISO 27001, CIS Controls, or CSA.
• Strong analytical, troubleshooting, and problem-solving skills.
• Ability to communicate technical concepts clearly to both technical and non-technical stakeholders.
• Ability to manage multiple priorities while working independently and collaboratively within a global team.

Nice to have

• Experience with vulnerability management and attack surface management platforms.
• Exposure to threat intelligence platforms, digital forensics, deception technologies, or third-party cyber risk tools.
• Experience implementing or administering endpoint security controls.
• Experience automating security processes through scripting or orchestration.
• Familiarity with cloud security frameworks and controls.
• Relevant cybersecurity certifications such as Security+, CySA+, GSEC, GCIH, GCIA, or CISSP.

WORKING MODEL

This role follows a hybrid model, requiring in-office presence two days per week at our Polanco office in Mexico City.