CSIRT Service Expert

Air Liquide; Petaling Jaya; On-site; MYR 180,000 - 280,000; Full time

Job summary

Air Liquide is expanding its CSIRT in Houston and seeking a seasoned security operations specialist to strengthen incident handling, containment, remediation, and the development of SOPs and playbooks. You will contribute to global efforts while maintaining rigorous security standards and timely responses.

You will collaborate across teams, speak English fluently, and bring 5–8 years in CSIRT/SOC. Proactive, autonomous, and team-oriented, you will drive improvements with a focus on detection and

Qualifications

• Minimum 5–8 years in Security Operations, with 2+ years actively hunting threats.
• Fluent in English and able to lead in a diverse, cross‑functional team.
• Experience translating complex security incidents into actionable guidance.

Responsibilities

• Incident handling, containment planning, remediation actions, and lessons learned.
• Write and industrialize SOPs and playbooks; document IT context and automate processes.
• Increase user awareness of group security policies and best practices.

Skills

Security Operations experience

Threat hunting

CTI frameworks proficiency

English fluency

Education

Master’s degree in IT Security

Tools

MISP

OpenCTI

Job description

The CSIRT (Cyber Security Incident Response Team) is responsible for the management of security incidents for the whole group. The CSIRT has offices in Paris, Houston, Radnor and Singapore. The position is to strengthen our present team in Houston. The missions are:

1) Incident handling:

• Investigation: incidents are investigated by members of the CSIRT (L3) in coordination with the local security officers in order to define the exact scope of the incident. The CSIRT analyst defines for each incident an action plan which aims to collect the artifacts needed on suspicious assets, replay binaries to extract the IOC (Indicator of Compromise), contact local teams of the group for obtaining additional information, …
• Containment: the analyst is in charge of defining the containment plan, elevate to the good decision level if the action must be approved and follow the actions
• Remediation: the CSIRT analyst also defines the remediation action plan for a return to normal and pilot remediation actions with technical teams
• Lessons learned: the analyst must formalize the lessons learned (including the Root Cause Analysis) and present results for eventual further actions

2) Writing procedures (industrialization):

CSIRT analysts enrich existing standard operating procedures (SOP) or create new ones, develop global playbooks, document the IT context of our information system, develop scripts and processes to automate activities, …

3) User awareness:

during incident handling, remind users of the group security policies and of best practices

4) Hunting & CTI:

conduct hypothesis-driven hunts (SIEM, IDS, PROXY, EDR, …) based on MITRE ATT&CK and threat intelligence on actors targeting the Group; leverage and enrich IOC/TTP feeds (OSINT, ISACs, peers) to contextualize incidents and turn successful hunts into new detection rules; participate in the different CTI activities.

5) CSIRT tooling:

the CSIRT has its own infrastructure (monitoring, malware analysis, …) and CSIRT analysts are involved in its evolution by adding new features or new tools (sandbox, scripts ...)

What You Bring to the Team

• The Foundation: You hold a Master’s degree in IT Security, or you have the battle-tested, real-world experience to match.
• The Milestones: You bring 5 to 8 years of experience in Security Operations, with at least 2 of those years spent actively hunting and responding to threats in a fast-paced CSIRT, CERT, or SOC environment.
• The Voice: Fluent in English, you are ready to collaborate, brainstorm, and lead in a diverse, multicultural team.

Your Technical Arsenal

• Threat Intel & Hunting: You are fluent in CTI frameworks (MITRE ATT&CK) and tooling (MISP, OpenCTI). You know how to manage IOCs/TTPs and can write sharp, effective detection and hunting queries.
• Network & Infrastructure: You have a deep understanding of Windows and Linux architectures, traditional security perimeters (Firewalls, Proxies, Reverse Proxies, VPNs), and core network protocols (HTTP, FTP, DNS, SSL).
• Incident Analysis: You know the modern threat landscape inside and out—from vulnerabilities to active attack vectors. You excel at analyzing logs and tearing down complex security architectures to find the anomalies.
• DFIR Capable: You bring solid hands‑on skills in digital forensics and analytics.

How You Operate (Mindset & Soft Skills)

• The Translator: You have excellent communication skills. You can synthesize highly complex technical situations into clear, actionable insights for any audience.
• Proactive & Autonomous: You don't just wait for alerts; you are a self-starter and a proactive innovator who brings fresh proposals to the table while seamlessly managing shifting priorities.
• Team-Centric & Agile: You thrive in collaborative environments, easily adapting to new technologies, shifting landscapes, and different team dynamics with a strong, service-oriented mindset.

Bonus Points (The Cherry on Top)

• Hands-on knowledge of Cloud Security (specifically AWS) or Industrial IT/OT Security.
• Industry-recognized heavy-hitter certifications: GCIH, GCIA, GCFE, GCFA, or GCTI.