Cybersecurity Lead — Detection & Incident Response

Nearshore Portugal; Porto; On-site; EUR 90,000 - 120,000; Full time

Job summary

Nearshore Portugal is seeking a Cybersecurity Lead – Detection & Incident Response to guide threat detection programs and incident handling. You will lead analysts, shape response playbooks, and ensure rapid containment and recovery across a multi-national environment.

The role requires 5+ years in incident detection and response, DFIR experience with Velociraptor or KAPE, and strong communication skills in English.

Qualifications

• 5+ years in incident detection and response.
• Experience in Digital Forensics and Incident Response (DFIR).
• Familiar with DFIR tools Velociraptor or KAPE.
• Experience with Cortex and vulnerability management.
• Strong investigative and decision-making under pressure.

Responsibilities

• Provide technical leadership and upskill analysts.
• Detect, investigate, and respond to incidents across the organization.
• Conduct digital forensic investigations and proactive threat hunting based on threat intelligence.
• Develop and tune detection rules.
• Create and maintain operational runbooks.
• Perform root cause analysis and post-incident reviews.
• Improve incident response plans and detection and response processes.
• Evaluate security technologies to strengthen detection and response capabilities.
• Validate and triage vulnerabilities, tracking remediation through to completion.
• Participate in emergency response activities when required.
• Provide regular reporting on security activities and findings.

Skills

Incident detection

DFIR tools

Threat hunting

Incident management

Team leadership

Communication skills

English language

Calm demeanor

Tools

Velociraptor

KAPE

Cortex

Job description

Nearshore Portugal is seeking a Cybersecurity Lead – Detection & Incident Response to guide threat detection programs and incident handling. You will lead analysts, shape response playbooks, and ensure rapid containment and recovery across a multi-national environment.

The role requires 5+ years in incident detection and response, DFIR experience with Velociraptor or KAPE, and strong communication skills in English.