Cybersecurity Incident Response Engineer

Key responsibilities· Investigate incidents involving endpoints, identities, cloud platforms, email, applications, data and networks.

· Perform triage, severity classification, impact analysis, containment, eradication, recovery and root-cause analysis.

· Execute incident response procedures and escalation paths in accordance with the CIRP and regional requirements.

· Analyze EDR, SIEM, MDR, email, cloud and threat-intelligence alerts and distinguish true incidents from false positives.

· Collect and preserve evidence, perform forensic triage, log analysis, malware investigation and timeline reconstruction.

· Conduct proactive threat hunts mapped to MITRE ATT&CK and emerging threat intelligence.

· Maintain complete incident records, timelines, evidence, findings, stakeholder updates and post-incident reports.

· Develop and improve playbooks, detection logic, SOAR workflows and response automations.

· Participate in on-call coverage, tabletop exercises, purple-team activities and major incident response.

Expected outcomes· Timely, evidence-based incident containment

· High-quality incident records and post-incident reviews

· Improved detection fidelity and playbook coverage

· Reduced recurring incidents through tracked remediation

· Operational participation in on-call and exercises

Operating conditions· Participation in an on-call or extended-hours response rota may be required, subject to approved policy, contractual arrangements and local employment requirements.

· Occasional travel may be required to support acquired businesses, exercises, investigations or integration work.

· The role handles confidential and potentially sensitive security, employee, client and regulated information.