Cybersecurity Incident Responder

Andersen; United States; Remote; USD 120,000 - 190,000; Full time

Benefits offered by this job

Private health insurance

Sports compensation

Mentoring & onboarding

Annual bonus potential

Training portal access

Referral program

Job summary

Andersen is seeking a Cybersecurity Incident Responder to safeguard critical systems across a complex international environment. You will handle the full incident lifecycle, perform digital forensics, and coordinate with client IT teams to contain and remediate threats.

You should have 5+ years in cybersecurity, 3+ years in hands-on incident response, and hands-on EDR/XDR experience. On-call rotation and strong English communication are required.

Qualifications

• 5+ years in cybersecurity with 3+ years in hands-on incident response.

Responsibilities

• Executing the full incident lifecycle: triage, containment, eradication, recovery, lessons learned.

Skills

Incident response

EDR/XDR

Digital forensics

Microsoft 365/Azure

NIST SP 800-61

On-call readiness

Background check

English proficiency

Tools

Volatility

KAPE

Velociraptor

FTK/EnCase

Job description

Andersen is hiring a Cybersecurity Incident Responder for a project protecting critical systems and managing security incidents in a complex international environment.

The customer is a large international organization that relies on modern technology and digital solutions to support its operations. Its activities involve secure IT infrastructure, data management, digital services, and the adoption of emerging technologies to improve operational efficiency and reliability.

The project is focused on providing cybersecurity and digital services for international organizations within a complex multi-tenant environment. It includes cyber defense operations, security incident management, and continuous protection of critical systems and services to ensure secure and reliable operations worldwide.

Responsibilities:

• Executing the full incident lifecycle: triage, containment, eradication, recovery and lessons learned.

• Performing digital forensics on endpoints, servers and cloud workloads (disk, memory, logs).

• Investigating escalated alerts from the SOC and determine the scope and impact of incidents.

• Coordinating response activities with affected client organizations, IT teams and management.

• Developing and maintaining IR playbooks and runbooks, and run tabletop exercises.

• Writing incident reports and rooting cause analyses, and recommend remediation.

• Taking part in on-call rotation (response within 15 minutes, system access within 1 hour).

Must-haves:

• Experience in cybersecurity for 5+ years, including 3+ years in hands-on incident response.

• Proven end-to-end handling of real incidents (e.g. ransomware, BEC, account compromise, data exfiltration).

• Hands-on EDR/XDR experience (e.g. Microsoft Defender for Endpoint, CrowdStrike, SentinelOne).

• Forensic tools and techniques: memory and disk analysis (e.g. Volatility, KAPE, Velociraptor, FTK/EnCase), Windows and Linux artifacts.

• Investigation in Microsoft 365, Entra ID and Azure environments.

• Strong knowledge of NIST SP 800-61 or SANS incident handling frameworks.

• Readiness for on-call rotation.

• Clean record, ready for background verification.

• Level of English – from Upper-Intermediate and above.

Nice to haves:

• Certifications: GCIH, GCFA, GCFE, GNFA, ECIH.

• Cloud forensics in AWS or GCP.

• Malware triage and basic reverse engineering.

• Scripting in Python or PowerShell.

• Experience in a MSSP or a multi-tenant environment.

Reasons why this job would be interesting to you:

• Experience in teamwork with leaders in FinTech, Healthcare, Retail, Telecom, and others. Andersen cooperates with such businesses as Samsung, Siemens, Johnson & Johnson, BNP Paribas, Ryanair, Mercedes, TUI, Verivox, Allianz, T-Systems, etc..

• The opportunity to change the project and/or develop expertise in an interesting business domain.

• Guarantee of professional, financial, and career growth! The company has introduced systems of mentoring and adaptation for each new employee.

• The opportunity to earn up to an additional 1,000 EUR per month, depending on the level of expertise, which will be included in the annual bonus, by participating in the company's activities.

• Access to the corporate training portal, where the entire knowledge base of the company is collected and which is constantly updated.

• Bright corporate life (parties / pizza days / PlayStation / fruits / coffee / snacks / movies).

• Certification compensation (AWS, PMP, etc).

• Referral program.

• Private health insurance and sports compensation, depending on the type of employment.

Your personal data is protected in accordance with GDPR regulations. Learn more: https://andersenlab.com/privacy-policy/pl