Security Operations & Incident Response Analyst

Reporting to the Global CISO, the Security Operations & Incident Response Analyst (L3) will join Aleph's global IT Security team as the first line of defence when incidents occur and the engine behind the team's threat detection and response capabilities. The role owns the end-to-end incident response process, leads threat hunting and intelligence activities, and manages the vulnerability and identity governance programmes across a complex, globally distributed environment.

Responsibilities

Own and coordinate the end-to-end incident response process: identification, triage, containment, eradication, recovery, and post-incident review; Serve as the primary point of contact for security incidents escalated from IT Operations, the Security Engineer, and external sources; Maintain and continuously improve incident response playbooks for relevant threat scenarios; Manage the security incident log and register, and produce trend analysis and reporting for the CISO; Coordinate with external SOC or MDR providers: review daily reports, validate alert quality, and manage escalation workflows; Lead data breach investigations: scope the breach, gather and preserve evidence, assess PII exposure, and coordinate with Legal, Privacy, and HR; Produce breach investigation reports with findings, root cause, and recommendations; Conduct proactive threat hunting based on threat intelligence and investigate anomalous behaviour; Manage the Threat Intelligence function, tracking threat actors, TTPs (MITRE ATT&CK), and sector-specific campaigns, and integrate intelligence into SIEM/XDR rules; Produce threat intelligence summaries and briefings for the CISO and stakeholders; Own the vulnerability management programme: schedule and execute vulnerability scans, prioritise findings, coordinate remediation with IT Operations within SLAs, track progress, and validate remediation; Manage periodic access reviews with system owners and HR to ensure least privilege; Oversee the Privileged Access Management (PAM) programme, including policies, privileged account monitoring, and administrator access reviews; Investigate and respond to identity-related anomalies and access policy violations

Requirements

3–5 years in a SOC analyst, incident response, or security operations role; at least 1–2 years at L3 level is a plus; Experience implementing or managing IAM and PAM solutions; Experience working within international or multinational environments; Hands-on experience with incident response engagements (internal or consulting) is strongly valued; Relevant certifications: GCIH, GCFE, GCFA, CEH, CompTIA CySA+, or equivalent; Strong hands-on experience with SIEM platforms (alert triage, rule writing, query development) and EDR/XDR tools; Solid knowledge of the MITRE ATT&CK framework and its application to threat hunting and incident response; Experience conducting vulnerability scans using tools such as Tenable Nessus, Qualys, Rapid7, or similar; Familiarity with IAM and PAM concepts and platforms (e.g. CyberArk, BeyondTrust, Azure PIM, or equivalent); Experience with DFIR methodologies: evidence collection, log analysis, and timeline reconstruction; Knowledge of threat intelligence platforms and feeds (e.g. MISP, VirusTotal, threat intel feeds); Understanding of ISO 27001 incident management controls, NIS2 incident reporting obligations, and PCI DSS requirement 12.10; Calm and decisive under pressure; Strong investigative mindset with structured problem-solving approach and excellent documentation skills; Ability to communicate incident status and findings clearly to both technical teams and executive stakeholders; Collaborative and proactive, comfortable working asynchronously across time zones; English: full professional proficiency (C1/C2), primary working language

Nice to have

OSCP certification; Spanish professional proficiency; 1–2 years at L3 level

Benefits

Annual variable component paid annually