We are looking for a SOC & Incident Response Lead to shape how our operational defense works. You’ll set the workflows, investigation standards and team rhythm, lead SOC analysts and IR & Forensics specialists, and turn security alerts into timely, evidence-based decisions and coordinated response that protect critical systems and data.
What you’ll do
Build and mature the SOC and IR/DFIR function: define investigation standards, workflows and playbooks
Lead and grow SOC analysts (L1/L2) and IR & Forensics specialists, owning prioritization, coaching and investigation quality
Own alert queue prioritization, triage standards, escalation thresholds and handovers to keep SLA risks under control
Set case creation, enrichment and evidence standards so confirmed incidents reach responders with full business and technical context
Coordinate incident investigations: assign response roles and maintain timelines, evidence logs, decision records and action tracking
Supervise forensic preservation and analysis of endpoint, server, cloud, network and identity telemetry with strict chain of custody
Coordinate containment, eradication and recovery validation with IT, Platform, IAM, Product and business owners within the approved authority matrix
Escalate production-impacting incidents, high-impact containment and regulatory or legal triggers through Cyber Defense leadership and approved decision paths
Partner with Detection Engineering to turn recurring false positives and detection gaps into tuning while keeping coverage
Run post-incident reviews and RCA, turning findings into tracked, measurable improvements
Maintain operational metrics, sample case quality, update playbooks, run readiness exercises and recommend changes to escalation thresholds and staffing coverage
What you bring
3+ years in SOC and IR/DFIR, including mentoring, coaching or leading technical specialists
A degree or training in InfoSec, Computer Science or IT, or equivalent hands-on SecOps/IR experience
Hands-on SIEM and XDR/EDR skills, with the ability to correlate endpoint, identity, network and cloud events into a defensible timeline
Strong alert queue management and SLA enforcement, prioritizing by asset criticality, identity and business impact
Solid knowledge of forensic evidence collection, preservation, referencing and chain of custody
A track record of building runbooks, case checklists and review frameworks that separate facts from assumptions
Experience working with Detection Engineering to cut noise without compromising coverage
A clear grasp of containment authority limits, escalation paths and regulatory or legal considerations in IR
Calm, evidence-based judgment under pressure, clear communication with technical and business stakeholders, and strict care with confidential evidence
English at Upper-Intermediate or higher
Nice to have
Background in fintech, trading, financial services or other high-availability environments
Scripting (Python, PowerShell, Bash), advanced queries, or safe automation for enrichment, triage and reporting
Cloud investigations (AWS, Azure, GCP), threat hunting or detection engineering
Certifications such as GIAC (GCIH, GCFA, GNFA), BTL1/BTL2, CISSP, CySA+ or vendor credentials
Work format Full-time, remote, regular schedule, no shift work. On-call may be arranged; rotation and terms are agreed together.
What we offer
20 paid vacation days per year
10 paid sick leave days per year
Public holidays as per the company’s approved Public holiday list
Medical budget
Opportunity to work remotely
Professional education budget
Language learning budget
Wellness budget (gym membership, sports gear and related expenses)
