Senior Associate, Cybersecurity Incident Response CSIRT - Advanced English

KTSA - KPMG Technology Services Americas; Región Centro; Hybrid; MXN 600,000 - 900,000; Full time

Benefits offered by this job

Extended maternity/paternity/adoption

Learning opportunities, training, and证

Wellness and EAP

Comprehensive medical plan

Life insurance

Car insurance

Funeral assistance

Job summary

KTSA – KPMG Technology Services Americas is expanding its cybersecurity operations center across Mexico, delivering high-value security services to KPMG US and clients. The role focuses on incident response, threat hunting, and proactive defense, with a strong emphasis on automation and collaboration with internal tech groups.

The ideal candidate has 3+ years in cybersecurity operations, relevant certifications, scripting/automation experience, and excellent English communication.

Qualifications

• Minimum three years of cybersecurity operations experience.
• Experience implementing monitoring and incident response playbooks.
• Experience with scripting or automation and ServiceNow.
• Excellent verbal/written English communication, collaboration, analytical and presentation skills.

Responsibilities

• Utilize expertise in IT security, security operations, and incident response to maintain 24x7 cybersecurity operations and protect assets.
• Handle incident management, threat hunting, forensic analysis, and remediation efforts.
• Configure and monitor security tools, automate and orchestrate for a unified monitoring/response.
• Apply threat intelligence to assess risk and improve preventive controls.
• Mentor the team and collaborate with internal tech groups for strategic alignment.
• Support small projects, threat assessments, and incident investigations with deadlines.

Skills

CrowdStrike

Zscaler

Education

Bachelor's degree preferred

Certifications such as CISSP, CCSP, GSEC, GCIH, GCFA, CEH, AZ-900 preferred

Tools

Proofpoint

Recorded Future

Cortex XSOAR

Job description

We are KTSA – KPMG Technology Services Americas.

A Service Delivery Center of KPMG US, with offices in Mexico City, Guadalajara, and a growing network of remote talent across the country. We deliver high-value technology, consulting, and corporate support services to KPMG US and its clients.

At KTSA, our Employer Value Proposition is clear: Explore.

Explore isn’t just a word — it’s how we grow, lead, and thrive. It’s the mindset that drives our culture and shapes every opportunity:

• Experience a collaborative, inclusive, and multicultural workplace where you belong.
• Excel by creating impact and leaving your mark on global projects.
• Expand your potential with real career paths, learning programs, and mentorship.
• Express your individuality — come as you are, and thrive as your authentic self.

And because we know that thriving at work also means thriving in life, we back this mindset with KTSAMÁS, our total rewards program, designed to support your well‑being, goals, and personal milestones.

Key Responsibilities:

• Utilize your expertise in IT security, security operations, and incident response to enhance and maintain robust 24x7 cybersecurity operations, ensuring swift and effective handling of incidents and ongoing protection of organizational assets.
• Handle and coordinate tasks such as incident management, threat hunting, forensic analysis, and remediation efforts to mitigate threats. Conduct regular assessments to identify vulnerabilities and insecure configurations and review security change requests to ensure robust protective measures.
• Configure and monitor security tools, including alerts, correlation rules, and reporting mechanisms. Implement automation and orchestration to improve the efficiency and effectiveness of security monitoring and response processes, aiming for a unified "single pane of glass" solution.
• Leverage intelligence to apply threat monitoring and vulnerability detection to evaluate and respond effectively to events and developing risk severity level and mitigation approaches, incorporating feedback and lessons learned into enhanced preventive and detective controls.
• Stay updated on the latest security practices and technologies, mentor the team through knowledge‑sharing sessions, and build strong relationships with internal tech groups to ensure strategic alignment and foster collaboration.
• Develop work product(s) and support small projects, threat assessments, and incident investigations while managing deadlines, expectations, and contributing to staffing decisions.

Required Qualifications:

• Minimum three years of experience in cybersecurity operations with experience implementing processes and playbooks in cybersecurity monitoring and incident response activities
• Bachelor's degree from an accredited college or university is preferred; relevant certifications such as: CISSP, CCSP, CCSK, GSEC, GCIH, GCFE, GCFA, SC-200, CEH, and AZ-900 are preferred
• Experience with scripting or automation, and ServiceNow
• Palo Alto Cortex XSOAR is a plus
• Excellent verbal/written English communication, collaboration, analytical and presentation skills.

Skills:

• CrowdStrike
• Zscaler

Email Protection

• Proofpoint
• Recorded Future
• Orchestration and Automation Cortex XSOAR

Cloud

• Python (preferred)
• Shell Script

Working hours:

Sunday - Wednesday or Wednesday to Saturday

• 7:00am to 5:00pm or 1pm to 11:00pm

Expand your possibilities with KTSA through KTSAMÁS, where you can access:

• Extended maternity, paternity, and adoption leaves
• Learning opportunities, training, and certification programs
• Extended marriage leave and daycare support
• Wellness and Employee Assistance Programs (EAP)
• Comprehensive medical plan, life insurance, car insurance, and funeral assistance

Visit www.ktsa.com.mx to learn more.

At KTSA, we celebrate and support everyone’s individuality. We do not discriminate against any race, religion, color, national origin, gender, sexual orientation, gender identity or expression, age, marital status, or disability. We are supportive of helping you to achieve a balance between your home and work demands. We are happy to discuss specific requirements and our range of flexible working arrangements could be of interest. Please ask to find out more. We strongly state that we DO NOT require a certificate of non‑pregnancy or HIV in order to participate in any of our processes.

Explore KTSA, we dare to be different!