Senior Cybersecurity Incident Handler

Hexa People; Lisboa; On-site; EUR 70,000 - 95,000; Full time

Job summary

Hexa People in Lisbon is seeking an experienced Cybersecurity Incident Handler to join a hands-on security operations team. You will serve as the on-site contact between the remote SOC and client IT teams, coordinating investigations and timely response actions.

The role requires strong incident management, technical investigation skills, and the ability to communicate with business and technical stakeholders. On-site work in Lisbon is required.

Qualifications

• Degree or relevant vocational qualification in Computer Science, IT, or Electrical Engineering.
• 5+ years of experience in SOC operations and incident response.
• Hands-on knowledge of IBM QRadar SIEM and standard security technologies.

Responsibilities

• Coordinate the full incident response lifecycle from initial assessment to containment and recovery.
• Analyse events, correlate logs and reconstruct timelines to identify attack paths and exfiltration.
• Provide technical recommendations and coordinate containment and remediation with IT teams.
• Investigate suspicious network traffic and security alerts across enterprise environments.
• Serve as on-site liaison between the remote SOC and client stakeholders with clear communication.

Skills

SOC operations

Cybersecurity incident response

Incident investigation

Stakeholder communication

English proficiency

Portuguese communication

Education

Degree or vocational qualification in Computer Science / IT / Electrical Engineering

Tools

IBM QRadar SIEM

Microsoft Defender

Microsoft 365

Azure

Cisco

Fortinet

Check Point

Job description

Role Overview

We are looking for an experienced Cybersecurity Incident Handler to join a challenging security operations environment in Lisbon.

You will act as the on-site technical point of contact between a remote Security Operations Centre (SOC) and the client's internal teams, coordinating security incident investigations and ensuring timely, effective response actions.

This is an excellent opportunity for a hands-on cybersecurity professional who combines strong technical investigation skills with the ability to manage critical incidents and communicate confidently with business and technical stakeholders.

Key Responsibilities

• Coordinate the full cybersecurity incident response lifecycle, from initial assessment and investigation to containment, eradication and recovery.
• Analyse security events, correlate logs and reconstruct incident timelines to identify attack paths, lateral movement and potential data exfiltration.
• Provide technical recommendations and coordinate incident containment, remediation and recovery activities with internal IT teams.
• Investigate suspicious network traffic, security alerts and abnormal behaviour across enterprise environments.
• Act as the primary on-site technical liaison between the remote SOC and client stakeholders, ensuring clear communication and effective incident management.

Requirements

• Degree or relevant vocational qualification in Computer Science, Information Technology, Electrical Engineering or a related field.
• Strong Portuguese communication skills and technical English proficiency are preferred; final language requirements will be confirmed.
• At least 5 years of experience in SOC operations and cybersecurity incident response, with proven knowledge of IBM QRadar SIEM.
• Hands-on knowledge of Microsoft Azure, Microsoft Defender and Microsoft 365, combined with practical network security experience involving Cisco, Fortinet and Check Point technologies.
• Strong incident investigation, analytical and stakeholder communication skills, with the ability to work on-site in Lisbon and attend P1 incidents within 2 hours outside normal working hours.