Senior Cybersecurity Incident Response Specialist

EX Squared

Región Centro

Hybrid

MXN 900,000 - 1,400,000

Full time

14 days+

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Benefits offered by this job

Career growth opportunities

Meal vouchers

Savings fund

Certifications support

Remote-work allowance

Job summary

EX Squared LATAM is partnering with a leading global professional services organization to recruit a Senior Cybersecurity Incident Response Specialist for its Mexico operations. The role focuses on hands-on SOC operations, incident response, threat hunting, and forensics within a complex, global environment.

The ideal candidate has at least 3 years of practical experience in incident response, with advanced English and the ability to work in a hybrid model (2–3 days onsite in Mexico City or

Qualifications

Minimum 3 years of hands-on Cybersecurity Operations / Incident Response experience.
Direct experience participating in security incident investigation and response.
Experience with threat hunting and security monitoring activities.
Experience performing forensic analysis during investigations.
Experience identifying vulnerabilities and coordinating remediation.

Responsibilities

Participate directly in cybersecurity monitoring, incident investigation, containment, remediation, and response activities.
Investigate security incidents to determine scope, severity, impact, and mitigation actions.
Conduct threat hunting to identify suspicious behaviors and threats not detected by standard alerts.
Support forensic analysis and investigations to identify root cause and attacker activity.
Identify vulnerabilities and insecure configurations and coordinate remediation actions.
Develop and improve incident response processes and playbooks.
Configure and monitor security tools, alerts, dashboards, and reporting.
Apply threat intelligence to monitoring and investigations.
Determine risk severity and mitigation approaches for security events.
Incorporate lessons learned into preventive and detective controls.
Support automation and orchestration to improve efficiency.
Collaborate with internal teams during investigations and remediation.
Document findings, evidence, remediation actions clearly.
Stay current with emerging threats and security practices.

Skills

Cybersecurity Operations

Incident Response

Threat Hunting

Forensic Analysis

Security Monitoring

SOC

Communication

English Proficiency

Tools

CrowdStrike

Microsoft Defender for Endpoint

Zscaler

Proofpoint

Recorded Future

Microsoft Azure

Cortex XSOAR

Job description

At EX Squared LATAM, we partner with leading organizations across global and regional markets to connect exceptional professionals with high-impact career opportunities.

Our client is a leading global organization in the professional services and consulting industry, supporting businesses with complex technology, cybersecurity, risk, compliance, and transformation initiatives.

For this position, EX Squared LATAM is supporting our client with the recruitment and selection process. The selected professional will be hired directly by the client under their local payroll in Mexico, becoming part of their internal team.

Role Overview

We’re currently looking for a Senior Cybersecurity Incident Response Specialist to support cybersecurity operations and respond directly to security incidents within a complex, global environment.

This is a hands-on operational cybersecurity role focused on SOC operations, Incident Response, threat hunting, forensic analysis, vulnerability identification, remediation, security monitoring, and incident response playbooks.

The ideal candidate will bring at least 3 years of practical Cybersecurity Operations / Incident Response experience and will have participated directly in investigating and responding to security events rather than working primarily in coordination, ticket management, SLA tracking, escalation management, or ITIL-driven processes.

Company Title

Senior Associate – Cyber Operations (Incident Response)

Location

For professionals based in Mexico City or Guadalajara, the position follows a hybrid model with onsite attendance approximately 2–3 days per week.
Candidates based in other cities in Mexico may be considered for a remote arrangement; however, Mexico City and Guadalajara profiles will receive priority.

Contract Duration

Permanent, direct employment with the client.

Working Hours

This position operates under 10-hour shifts, with one of the following schedules:

Sunday through Wednesday, or
Wednesday through Saturday.

Available shifts are:

7:00 a.m. – 5:00 p.m., or
1:00 p.m. – 11:00 p.m.

The schedules are not rotational. Candidates may indicate their preferred schedule, which will be confirmed based on business needs and availability.

Language Requirement

Advanced English.

What you'll do

Participate directly in cybersecurity monitoring, incident investigation, containment, remediation, and response activities.
Investigate security incidents and alerts to determine scope, severity, impact, and appropriate mitigation actions.
Conduct threat hunting activities to identify suspicious behaviors and potential threats that may not be detected through standard alerts.
Support forensic analysis and incident investigations to identify root cause and understand attacker activity.
Identify vulnerabilities and insecure configurations and coordinate appropriate remediation actions.
Develop, implement, maintain, and improve incident response processes and playbooks.
Configure and monitor security tools, including alerts, correlation rules, dashboards, and reporting mechanisms.
Apply threat intelligence to security monitoring, vulnerability detection, and incident investigations.
Help determine risk severity and appropriate mitigation approaches for security events.
Incorporate lessons learned from incidents into improved preventive and detective security controls.
Support automation and orchestration initiatives that improve the efficiency of monitoring and response processes.
Collaborate with internal technology, infrastructure, security, and business teams during investigations and remediation efforts.
Document incident findings, technical evidence, remediation actions, and recommendations clearly.
Stay current with emerging threats, attacker techniques, security technologies, and cybersecurity operations practices.

What you'll bring

Minimum 3 years of hands-on experience in Cybersecurity Operations, SOC, Incident Response, or similar operational security roles.
Direct experience participating in security incident investigation and response.
Hands-on exposure to threat hunting and security monitoring activities.
Experience supporting or performing forensic analysis during security investigations.
Experience identifying vulnerabilities, insecure configurations, and security risks and supporting their remediation.
Experience implementing or working with Incident Response processes and playbooks.
Understanding of security event analysis, alert triage, escalation, containment, remediation, and post-incident activities.
Experience configuring, monitoring, or using security technologies within SOC or Incident Response environments.
Familiarity with endpoint, network, email, threat intelligence, and cloud security concepts.
Strong analytical and troubleshooting skills and the ability to investigate complex security events.
Ability to clearly communicate technical findings, risks, and recommended actions to different audiences.
Strong written and verbal English communication skills.

What will make you stand out

Hands-on experience with technologies such as CrowdStrike, Microsoft Defender for Endpoint, Zscaler, Proofpoint, Recorded Future, and Microsoft Azure.
Experience with Palo Alto Cortex XSOAR or comparable SOAR platforms.
Experience implementing security automation and orchestration workflows.
Scripting experience using Python, Shell, or similar languages.
Experience with ServiceNow in a cybersecurity operations environment. The source JD specifically lists ServiceNow and Cortex XSOAR as pluses.
Certifications such as CISSP, CCSP, CCSK, GSEC, GCIH, GCFE, GCFA, SC-200, CEH, AZ-900, or similar cybersecurity credentials.
Experience improving SOC processes, detection capabilities, or Incident Response playbooks.
Exposure to threat intelligence and the ability to apply intelligence to active security monitoring and investigations.
Experience working in 24x7 cybersecurity operations environments.

Why this opportunity?

This is an opportunity to join a large, globally recognized organization in the professional services and consulting industry, working with international teams on sophisticated cybersecurity operations and Incident Response initiatives.

The role is especially suited for a cybersecurity professional who wants to remain close to the technical and operational side of security, investigating real incidents, analyzing threats, improving detection capabilities, and supporting remediation across enterprise environments.

It offers exposure to modern security technologies, complex investigations, threat intelligence, automation, cloud environments, and U.S.-based stakeholders.

What the Client Offers