Cybersecurity Incident Response Officer – Sentinel & SIEM

Our client, a prominent organization in the transport and infrastructure sector, is seeking a Cybersecurity Incident Response Officer to join their cybersecurity team. This role focuses on the end-to-end incident lifecycle, proactive threat hunting, and the optimization of advanced security monitoring systems.

Responsibilities: Investigate and respond to level 3 and 4 security incidents, including network intrusions, malware infections, and data breaches. Conduct digital forensic investigations and analyze security artifacts across IT, IoT, and OT environments. Perform proactive threat hunting using SIEM and custom tools to identify anomalous behaviors and indicators of compromise. Develop and optimize detection rules and use cases based on the MITRE ATT&CK framework.

Automate security event responses and develop playbooks to streamline operations within the SOC and CSIRT. Coordinate with internal stakeholders and external security providers to communicate incident progress and mitigate risks.

Requirements: You have 4+ years of experience in a security-focused role with a core specialization in incident response and analysis. You possess deep expertise in security monitoring using Sentinel SIEM, EDR, and Microsoft Defender. You bring hands-on experience with digital forensics, malware analysis, and artifact analysis for Windows and Linux systems. You're experienced in SOC Engineering, including use case development and the automation of alert handling.

You possess working knowledge of the MITRE ATT&CK framework and ServiceNow SIR modules. You have experience in the organization and animation of security tabletop exercises. You have obtained relevant certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, or GREM. You have strong analytical and problem-solving skills with the ability to identify suspicious activities on complex networks. You have a Bachelor's degree in Computer Science, Information Security, or equivalent professional experience.

You are fluent in English (C1) with working knowledge of Dutch or French.

Offer: Start date: 01/01/2027.

Duration: Until 31/12/2027.

Work regime: Full-time.

Location: Brussels.

Working model: Hybrid (onsite presence required up to 5 days per week).

Contract: open to both permanent employees and freelancers.