Security and Incident Response Lead

Blue Yonder; Monterrey; Presencial; MXN 1,292,000 - 1,663,000; Jornada completa

Descripción de la vacante

A leading AI solutions provider in Monterrey is seeking a Security Incident Manager to oversee security incidents, coordinate with teams to mitigate threats, and improve incident response playbooks. The ideal candidate has over 5 years of experience in cybersecurity and strong expertise in cloud security technologies across major providers. This role plays a critical part in maintaining the organization's security posture.

Formación

• 5+ years of experience in information security or cybersecurity.
• Strong familiarity with cloud security technologies across major cloud providers.
• Knowledge of security frameworks such as NIST and ISO 27001.

Responsabilidades

• Monitor and analyze security alerts to determine appropriate actions.
• Conduct root cause analysis of security incidents.
• Develop and improve incident response playbooks.

Conocimientos

Incident response

Threat hunting

Cybersecurity

Cloud security

Educación

Bachelor's degree in Computer Science or related field

Herramientas

Security Information and Event Management (SIEM)

Endpoint Detection and Response (EDR)

Threat Intelligence Platforms (TIP)

Descripción del empleo

Overview

Blue Yonder is a Leading AI-driven Global Supply Chain Solutions Software Product Company and one of Glassdoor’s “Best Places to Work”. This role is responsible for overseeing the detection, investigation, containment, and remediation of security incidents to protect an organization's systems, data, customers and reputation. Candidate will lead high-priority incident response efforts, coordinating with cross-functional teams such as IT, legal, and compliance to mitigate threats effectively.

What you’ll do

• Monitor and Analyze Security Alerts – Review alerts generated by security systems, appliances, and logs to determine the appropriate course of action to protect the enterprise and reduce overall risk.
• Incident Triage and Response – Quickly assess, prioritize, and respond to security incidents, ensuring timely containment, eradication, and recovery to minimize business impact.
• Root Cause Analysis (RCA) – Investigate security incidents to determine root causes, attack vectors, and vulnerabilities, providing recommendations to reduce the attack surface and prevent recurrence.
• Threat Hunting and Proactive Defense – Conduct proactive threat-hunting activities based on intelligence, anomalies, and adversary tactics to identify and mitigate threats before they escalate.
• Collaboration with Cross-Functional Teams – Work closely with IT, engineering, legal, compliance, and other teams to coordinate incident response efforts and ensure an effective security posture.
• Incident Documentation and Reporting – Maintain detailed documentation of security incidents, response actions, and lessons learned, ensuring continuous improvement in security processes.
• Develop and Improve Incident Response Playbooks – Enhance and maintain incident response procedures, ensuring alignment with industry best practices and emerging threats.
• Security Awareness and Training – Provide guidance, training, and mentorship to SOC analysts and IT staff on security threats, incident handling, and response best practices.
• Threat Intelligence Integration – Leverage threat intelligence sources to stay informed on evolving cyber threats and proactively adjust security strategies to defend against them.

What we are looking for

• Bachelor's degree in Computer Science, Information Security, or related equivalent degree. In lieu of Bachelor's Degree, 8+ years of professional experience in information security, information technology or cybersecurity required.
• 5+ years of experience in information security, cybersecurity, or security.
• Knowledge of security frameworks such as NIST and ISO 27001
• Familiarity with security regulations and standards (e.g. PCI DSS, HIPAA, etc.)
• Experience with incident response methodologies and tools (e.g. SANS IR, Threat Intelligence, etc.)
• Knowledge of various operating systems, networks, and security technologies
• Security+ or Certified Incident Handler (GCIH) or equivalent certification preferred
• Strong familiarity with cloud security technologies and frameworks across major cloud providers (AWS, Azure, Google Cloud) is essential. The candidate should have experience with cloud-native security monitoring, incident response in cloud environments, and threat detection techniques to protect workloads, data, and identities in hybrid and multi-cloud architectures.

Candidate should have hands-on familiarity with all the below technologies

• Security Information and Event Management (SIEM)
• Endpoint Detection and Response (EDR) / Extended Detection and Response (XDR)
• Network Security Monitoring & Intrusion Detection/Prevention Systems (IDS/IPS)
• Threat Intelligence Platforms (TIP)
• Security Orchestration, Automation, and Response (SOAR)
• Digital Forensics and Incident Response (DFIR) Tools
• Malware Analysis & Reverse Engineering Tools
• Vulnerability Management & Assessment
• Web Application Security Testing Tools
• Cloud Security Monitoring & Protection
• Email Security & Phishing Protection
• Deception & Honeypot Technologies
• Data Loss Prevention (DLP)
• Privileged Access Management (PAM) & Identity Security
• Firewall & Next-Generation Firewall (NGFW) Solutions

Our Values

Our values unite us and drive our success – and the success of our customers. Core Values

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status.