Blue Team Lead: Threat Detection & Incident Response

Nearshore Portugal; Porto; On-site; EUR 70,000 - 100,000; Full time

Job summary

Nearshore Portugal seeks a Blue Team Lead to provide technical leadership in threat detection and incident response within an international cybersecurity team. You will help build and maintain detection and response capabilities, guide analysts, and drive security incidents through to resolution.

You will lead incident investigations, develop runbooks, and tune detection rules while collaborating with teams globally. Strong English and a calm, results‑oriented approach are essential.

Qualifications

• At least 5 years of experience in incident detection and response.
• Experience in DFIR with Velociraptor or KAPE.
• Experience with Cortex and vulnerability management.
• Strong incident management skills and a structured approach to investigations.
• Ability to guide analysts, collaborate across teams, and make decisions under pressure.
• Strong written and verbal communication skills.
• Calm, rigorous, and results‑oriented approach.
• Good command of English.

Responsibilities

• Provide technical leadership and support analysts’ skills development.
• Detect, investigate, and respond to security incidents across the organization.
• Conduct digital forensic investigations and proactive threat hunting based on threat intelligence.
• Develop and tune detection rules.
• Create and maintain operational runbooks.
• Perform root cause analysis and post-incident reviews.
• Improve incident response plans and detection and response processes.
• Evaluate security technologies to strengthen detection and response capabilities.
• Validate and triage vulnerabilities, tracking remediation through to completion.
• Participate in emergency response activities when required.
• Provide regular reporting on security activities and findings.

Skills

Incident detection

Incident response

DFIR

Leadership

English

Team guidance

Tools

Velociraptor

KAPE

Cortex

Job description

Nearshore Portugal seeks a Blue Team Lead to provide technical leadership in threat detection and incident response within an international cybersecurity team. You will help build and maintain detection and response capabilities, guide analysts, and drive security incidents through to resolution.

You will lead incident investigations, develop runbooks, and tune detection rules while collaborating with teams globally. Strong English and a calm, results‑oriented approach are essential.