Cybersecurity Lead – Detection & Incident Response

Nearshore Portugal; Porto; On-site; EUR 90,000 - 120,000; Full time

Job summary

Nearshore Portugal is seeking a Cybersecurity Lead – Detection & Incident Response to guide threat detection programs and incident handling. You will lead analysts, shape response playbooks, and ensure rapid containment and recovery across a multi-national environment.

The role requires 5+ years in incident detection and response, DFIR experience with Velociraptor or KAPE, and strong communication skills in English.

Qualifications

• 5+ years in incident detection and response.
• Experience in Digital Forensics and Incident Response (DFIR).
• Familiar with DFIR tools Velociraptor or KAPE.
• Experience with Cortex and vulnerability management.
• Strong investigative and decision-making under pressure.

Responsibilities

• Provide technical leadership and upskill analysts.
• Detect, investigate, and respond to incidents across the organization.
• Conduct digital forensic investigations and proactive threat hunting based on threat intelligence.
• Develop and tune detection rules.
• Create and maintain operational runbooks.
• Perform root cause analysis and post-incident reviews.
• Improve incident response plans and detection and response processes.
• Evaluate security technologies to strengthen detection and response capabilities.
• Validate and triage vulnerabilities, tracking remediation through to completion.
• Participate in emergency response activities when required.
• Provide regular reporting on security activities and findings.

Skills

Incident detection

DFIR tools

Threat hunting

Incident management

Team leadership

Communication skills

English language

Calm demeanor

Tools

Velociraptor

KAPE

Cortex

Job description

Cybersecurity Lead – Detection & Incident Response

Description

We are looking for a Cybersecurity Lead – Detection & Incident Response to provide technical leadership in threat detection and incident response. You will help build and maintain detection and response capabilities, guide analysts, and drive security incidents through to resolution.

Requirements

• At least 5 years of experience in incident detection and response.
• Experience in Digital Forensics and Incident Response (DFIR), including tools such as Velociraptor or KAPE.
• Experience with Cortex and vulnerability management.
• Strong incident management skills and a structured approach to investigations.
• Ability to guide analysts, collaborate across teams, and make decisions under pressure.
• Strong written and verbal communication skills.
• A calm, rigorous, and results-oriented approach.
• Good command of English.

Responsibilities

• Provide technical leadership and support analysts’ skills development.
• Detect, investigate, and respond to security incidents across the organization.
• Conduct digital forensic investigations and proactive threat hunting based on threat intelligence.
• Develop and tune detection rules.
• Create and maintain operational runbooks.
• Perform root cause analysis and post-incident reviews.
• Improve incident response plans and detection and response processes.
• Evaluate security technologies to strengthen detection and response capabilities.
• Validate and triage vulnerabilities, tracking remediation through to completion.
• Participate in emergency response activities when required.
• Provide regular reporting on security activities and findings.

Working conditions

• International environment with English as the working language.
• Close collaboration with the cybersecurity team, reporting to the CISO.
• Opportunity to shape detection and response capabilities across a global organization.
• Participation in emergency response activities when required.