Incident Response Analyst

About the role

CyberOne is seeking an experienced Incident Response Analyst to join its cyber security team. You will protect organisations from cyber threats by leading investigations, conducting digital forensics, performing threat hunting, and improving incident detection and response.

Key responsibilities

• Monitor and analyse alerts from SIEM, EDR/XDR, identity, email, cloud and network platforms, triage incidents and coordinate containment, eradication and recovery.
• Collect, preserve and analyse endpoint, server, network and cloud artefacts, identify IOCs and map findings to the MITRE ATT&CK framework.
• Develop and execute proactive threat‑hunting activities, create and tune detection rules, and support purple‑team and penetration‑testing exercises.
• Act as a trusted security advisor for clients, lead communications during incidents and facilitate post‑incident reviews and lessons learned.

Required profile

• Hands‑on experience in cyber incident response, SOC or cyber defence environments.
• Strong understanding of the incident response lifecycle and experience analysing Windows, Linux, authentication events, network traffic and security logs.
• Excellent analytical, problem‑solving and communication skills, able to work under pressure.

Required skills

• SIEM and EDR/XDR platforms (e.g., Microsoft Sentinel, Microsoft Defender XDR).
• Microsoft security technologies: Defender for Identity, Defender for Cloud, Microsoft 365.
• Forensic tools: EnCase, FTK, Velociraptor, Volatility, Wireshark.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain and NIST IR frameworks.
• Scripting/automation: PowerShell, Python, KQL.