INCIDENT RESPONSE ANALYST

LITIT; Poland; Remote; PLN 172,000 - 256,000; Full time

Benefits offered by this job

Remote work opportunities

Learning certificates and language学习

Language courses

Health insurance

Team building events

Project rotation

Office in Vilnius, Lithuania

Job summary

LITIT is seeking a Cyber Security Incident Response Analyst to detect, investigate, and respond to cybersecurity incidents across enterprise environments. The role focuses on the Microsoft security ecosystem including Sentinel, Defender XDR, Defender for Endpoint, Entra ID, Microsoft 365, and Azure.

You will work with Cloud, Infrastructure, IAM, Risk, Compliance, and other teams to coordinate response activities, improve detections, and drive incident response maturity.

Qualifications

• Practical experience in SOC, Cyber Security Incident Response, or similar security operations role.

Responsibilities

• Monitor and investigate security alerts using Microsoft Sentinel and Defender technologies.
• Triage incidents and determine severity, scope, impact, and required actions.
• Investigate phishing, malware, compromised accounts, suspicious authentication, data loss, and unauthorized access.
• Perform endpoint, identity, M365, Azure, email, and network investigations.
• Collect and analyse security logs, endpoint artefacts, authentication data, and network telemetry.
• Identify indicators of compromise (IOCs) and attacker techniques.
• Map attacker activity to MITRE ATT&CK where relevant.
• Coordinate containment, eradication, and recovery activities with technical teams.
• Threat hunting based on observed attacker behaviour and threat intelligence.
• Develop and tune Microsoft Sentinel queries, analytics rules, and detection use cases.
• Improve detections and reduce false positives.
• Identify logging, telemetry, and security control gaps.
• Maintain incident timelines, evidence, investigation records, and response actions.
• Support root cause analysis and post-incident reviews.
• Produce clear technical reports and management updates.
• Contribute to incident response playbooks, procedures, and cyber security exercises.

Skills

Analytical thinking

Troubleshooting

Communication skills

Decision making

Willingness to travel

Tools

Microsoft Sentinel

Microsoft Defender XDR

Microsoft Defender for Endpoint

Microsoft Entra ID

Microsoft 365

Azure

PowerShell

Python

Job description

ABOUT THE COMPANY

LITIT, a joint venture between NTT DATA and Reiz Tech, is a company with deep-rooted industry know-how, dedicated to innovation within the IT sector. Its primary focus is delivering high-quality solutions in the DACH region. With a commitment to excellence, LITIT combines the best of German precision, Japanese work ethics, and Lithuanian talent to provide unparalleled IT service and support to its clients.

ABOUT THE ROLE

As a Cyber Security Incident Response Analyst, you will be responsible for detecting, investigating, and responding to cyber security incidents across enterprise environments. You will work across the full incident lifecycle — from initial alert and triage through investigation, containment, recovery, and post-incident review. The role has a strong focus on the Microsoft security ecosystem, including Microsoft Sentinel, Defender XDR, Defender for Endpoint, Microsoft Entra ID, Microsoft 365, and Azure. You will also work closely with Cloud, Infrastructure, IAM, Risk, Compliance, and other technical teams to coordinate incident response activities and continuously improve security detection and response capabilities.

RESPONSIBILITIES

• Monitor and investigate security alerts using Microsoft Sentinel and Microsoft Defender technologies.

• Triage incidents and determine severity, scope, impact, and required response actions.

• Investigate phishing, malware, compromised accounts, suspicious authentication, data loss, and unauthorised access.

• Perform endpoint, identity, Microsoft 365, Azure, email, and network investigations.

• Collect and analyse security logs, endpoint artefacts, authentication data, and network telemetry.

• Identify indicators of compromise (IOCs) and attacker techniques.

• Map attacker activity to MITRE ATT&CK where relevant.

• Coordinate containment, eradication, and recovery activities with technical teams.

• Perform threat hunting based on observed attacker behaviour and threat intelligence.

• Develop and tune Microsoft Sentinel queries, analytics rules, and detection use cases.

• Improve existing detections and reduce false positives.

• Identify logging, telemetry, and security control gaps discovered during incidents.

• Maintain incident timelines, evidence, investigation records, and response actions.

• Support root cause analysis and post-incident reviews.

• Produce clear technical reports and management-level incident updates.

• Contribute to incident response playbooks, procedures, and cyber security exercises.

REQUIREMENTS

• Practical experience in SOC, Cyber Security Incident Response, or a similar security operations role.

• Strong hands‑on experience with Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Endpoint.

• Experience investigating Microsoft Entra ID identity and authentication activity.

• Experience investigating security incidents across Microsoft 365 and Azure environments.

• Understanding of Microsoft Defender for Identity and Microsoft Defender for Cloud.

• Strong KQL skills for security investigations, threat hunting, and detection development.

• Experience analysing Windows endpoint and security logs, with working knowledge of Linux security and log analysis.

• Good understanding of network security, traffic analysis, and packet captures.

• Understanding of IAM, endpoint security, email security, vulnerability management, and DLP.

• Strong understanding of the complete incident response lifecycle, including containment, eradication, recovery, and post-incident review.

• Knowledge of MITRE ATT&CK, Cyber Kill Chain, and NIST incident response practices.

• Understanding of forensic evidence handling and chain of custody principles.

• Strong analytical and troubleshooting skills with the ability to independently investigate complex security incidents.

• Ability to prioritise and make decisions during active incidents.

• Strong communication skills and the ability to explain technical findings clearly to both technical and non-technical stakeholders.

• Willingness and readiness to travel as required by project or client needs is expected. This may include occasional domestic or international travel, sometimes on short notice.

NICE TO HAVE:

• PowerShell or Python scripting and security automation experience.

• Experience with Microsoft security detection engineering, threat hunting, or SOAR.

• Digital forensics or malware analysis experience.

• Experience with Microsoft Purview security or DLP capabilities.

• Experience working in banking, financial services, or another regulated environment.

• Experience supporting major or high‑severity security incidents.

• Relevant certifications such as Microsoft SC-200, GCIH, GCIA, GCFA, CySA+, CISSP, or equivalent.

WHAT WE OFFER

• Salary range: €3500 - €5200 (GROSS) / month.

• Learning opportunities with compensated certificates, learning lunches, and language lessons.

• Chance to switch projects after one year.

• Team building twice a year.

• Office in Vilnius, Lithuania that offers themed lunches and a pet-friendly environment.

• Remote work opportunities.

• Flexible time off depending on a project.

• Seasonal activities with colleagues.

• Additional health insurance and loyalty days for Lithuanian residents.

• Referral bonuses.

• Recognition of important occasions of your life.