Security Risk Management

LaPieza; Mexico; On-site; PHP 4,991,000 - 6,862,000; Full time

Job summary

LaPieza is seeking an experienced cybersecurity operations professional to join a 24x7 monitoring and incident response team. You will own incidents end to end—from detection to remediation—and collaborate with US-based technology teams under a Mexico-based lead.

In this hands-on role you will configure security tooling, manage alerts and playbooks, and help strengthen defenses through threat intel, analytics, and mentoring of colleagues in a matrixed environment.

Qualifications

• 3+ years of hands-on experience in cybersecurity operations with ownership of incidents through containment, eradication and remediation.
• ServiceNow — the team receives and manages vulnerabilities, risks and alerts through this platform, so working knowledge is essential.
• EDR platforms — hands-on experience with Microsoft Defender for Endpoint and/or CrowdStrike Falcon and/or Zscaler.
• SIEM experience — you have worked daily inside a SIEM platform and can configure alerts, correlation rules and reporting mechanisms.
• Advanced English, written and verbal. You will communicate risk and technical information in a matrixed international environment.
• Strong analytical, collaboration and presentation skills.

Responsibilities

• Own and coordinate incident management, threat hunting, forensic analysis and remediation efforts.
• Configure and monitor security tooling, including alerts, correlation rules and reporting mechanisms.
• Leverage threat intelligence to monitor threats and detect vulnerabilities and assess event severity.
• Stay current on security practices and mentor teammates through knowledge-sharing sessions.
• Develop work products and support small projects, threat assessments and incident investigations.

Skills

Cybersecurity operations

Incident response

Advanced English

Tools

ServiceNow

Microsoft Defender for Endpoint

CrowdStrike Falcon

Zscaler

SIEM

Python

Shell scripting

Job description

About the role

Join a large, established Digital Security team operating 24x7 cybersecurity monitoring and incident response. This is a hands-on operational role: you will own incidents end to end — detect, investigate, contain, eradicate and remediate — not simply triage and escalation. You will report to a local leader in Mexico and work in close collaboration with technology teams in the United States. These are additive positions on an existing team. You will not be working alone.

What you'll do

• Apply your expertise in IT security, security operations and incident response to maintain robust 24x7 cybersecurity operations, ensuring swift and effective handling of incidents and ongoing protection of organizational assets.
• Own and coordinate incident management, threat hunting, forensic analysis and remediation efforts to mitigate threats. Conduct regular assessments to identify vulnerabilities and insecure configurations, and review security change requests to ensure robust protective measures.
• Configure and monitor security tooling, including alerts, correlation rules and reporting mechanisms. Implement automation and orchestration to improve the efficiency of security monitoring and response, working toward a unified "single pane of glass" solution.
• Leverage threat intelligence to monitor threats and detect vulnerabilities, assess event severity, define mitigation approaches, and feed lessons learned back into stronger preventive and detective controls.
• Stay current on security practices and technologies, mentor teammates through knowledge-sharing sessions, and build strong relationships with internal technology groups to ensure strategic alignment.
• Develop work products and support small projects, threat assessments and incident investigations, managing deadlines and expectations and contributing to staffing decisions.

What we're looking for

• 3+ years of hands-on experience in cybersecurity operations, with demonstrable ownership of incidents through containment, eradication and remediation — including implementing processes and playbooks for cybersecurity monitoring and incident response.
• ServiceNow — the team receives and manages vulnerabilities, risks and alerts through this platform, so working knowledge is essential.
• EDR platforms — hands-on experience with Microsoft Defender for Endpoint and/or CrowdStrike Falcon and/or Zscaler.
• SIEM experience — you have worked daily inside a SIEM platform and can configure alerts, correlation rules and reporting mechanisms, not only monitor dashboards built by others.
• Advanced English, written and verbal. You will communicate risk and technical information, and host meetings, in a matrixed international environment. Clear communication is itself a security control.
• Strong analytical, collaboration and presentation skills.

Nice to have

• Experience with SIEM platforms and writing correlation rules and detection use cases.
• Scripting or automation experience, preferably Python or shell scripting.
• Security orchestration and automation tooling, such as Palo Alto Cortex XSOAR. This is genuinely optional — we do not expect it.
• Certifications such as CISSP, CCSP, CCSK, GSEC, GCIH, GCFE, GCFA, SC-200, CEH or AZ-900.