Incident Response Analyst

Lisboa, Portugal

About the Position

We are hiring an Incident Response Analyst to join the Detection and Response team (SOC/CSIRT) of an international technology company, operating within a global follow-the-sun model. This person will provide continuous detection and response coverage for Western Europe, Africa, and the Americas, working closely with incident response analysts based in other locations to ensure around-the-clock protection.

The focus of this role is to support the group's cybersecurity strategy and enable innovative prevention, detection, and remediation capabilities in a cloud-native environment. With adversaries increasingly using AI to accelerate and scale their attacks, speed is the top priority: you will be expected to consistently drive down time-to-detect and time-to-remediate, using AI-powered tooling and automation to detect, contain, and eradicate threats faster than they can spread.

Responsibilities

• Detect, triage, investigate, and respond to security incidents end-to-end - from detection through containment, eradication, and recovery.
• Operate within a follow-the-sun model, coordinating disciplined handovers with analysts in other locations to maintain continuous coverage.
• Relentlessly drive down mean time to detect (MTTD) and mean time to respond and remediate (MTTR), treating speed as a primary measure of success.
• Design and continuously improve incident response playbooks and runbooks, ensuring appropriate, timely escalation.
• Build security automation, orchestration, and SOAR workflows so response is fast and repeatable, keeping manual processes to a minimum.
• Develop threat-driven detection and monitoring use cases, tuning alerts to maximize signal and minimize noise, while hunting for advanced threats without neglecting basic-hygiene alerts.
• Proactively threat hunt across cloud, endpoint, identity, and network telemetry, mapping adversary activity to frameworks such as MITRE ATT&CK.
• Run hands-on malware analysis and digital forensics (DFIR) investigations to establish root cause, scope, and impact.
• Detect and respond to AI-specific threats - prompt injection, model abuse, GenAI data leakage, and misuse of AI tools and agents - in close partnership with the AI Security function.
• Use AI-powered tooling and automation to accelerate detection, triage, investigation, and remediation, applying sound judgement to validate AI-generated output before acting on it.
• Coordinate stakeholders inside and outside the technology organization throughout the incident lifecycle, providing clear, timely updates to technical teams and senior management.
• Lead structured post-incident reviews and blameless post-mortems, turning lessons learned into concrete detection, process, and control improvements.
• Consume and operationalise threat intelligence to anticipate adversary behavior and sharpen detection coverage.
• Maintain incident records, timelines, and evidence to a forensically sound, audit-ready standard.
• Ensure compliance with regulatory requirements for preventive measures and incident reporting (e.g., DORA, GDPR breach notification), partnering with GRC, Legal, and Privacy as needed.
• Measure and report relevant security and response metrics to technology teams and senior management, and continuously improve cybersecurity tools and processes based on lessons learned.
• Participate in an on-call rotation and support incident-bridge / war-room coordination during major incidents.

Requirements

• At least 3–5 years of professional experience in information security, with hands-on experience in security monitoring and incident response (SOC, CSIRT, or detection-and-response environments).
• Demonstrated expertise in IT fundamentals (systems and networks), security best practices, and modern concepts (cloud, DevSecOps, containerisation, APIs, AI/ML, secure by design).
• Hands-on experience with security operations tooling - SIEM, EDR/XDR, SOAR, and cloud-native detection tooling across AWS, Azure, GCP, and Microsoft 365.
• Excellent knowledge of advanced persistent threats and adversary tools, techniques, and procedures, with familiarity with frameworks such as MITRE ATT&CK.
• Practical experience with digital forensics and/or malware analysis.
• Programming and scripting experience in Python or similar, for automation.
• Strong AI fluency - demonstrated ability to use AI-powered tools and automation to accelerate detection, investigation, and response, with judgement to validate AI output and awareness of AI-specific threats (prompt injection, model abuse, GenAI data leakage).
• Extensive understanding of the current threat landscape affecting the financial industry, particularly fintech.
• Understanding of current technology and regulatory trends affecting financial-institution information security programs (e.g., DORA, GDPR).
• Excellent written and verbal communication skills in English, and the ability to perform under pressure.
• Willingness to participate in an on-call rotation and work outside standard business hours during major incidents.
• Degree in computer science or a related field.
• Relevant GIAC certifications (e.g., GCIH, GCFA, GCIA, GNFA) or equivalent are an advantage.

Nice to Have

• Experience in a follow-the-sun or globally distributed SOC / CSIRT.
• Familiarity with AI security frameworks such as the OWASP Top 10 for LLM Applications, NIST AI RMF, or MITRE ATLAS.
• Detection engineering / detection-as-code experience.
• Threat intelligence and threat-hunting experience.

We Offer

• Opportunity to work in a dynamic, international environment.
• Competitive salary and benefits package.
• Professional development opportunities.
• Collaborative and inclusive work culture.

About the Company

Join our Detection and Response team as an Incident Response Analyst to ensure around-the-clock protection using AI-powered tools.