Senior Incident Response Specialist

Job Description

Help AG is looking for a talented and experienced Senior Incident Response Specialist who will be responsible for identifying, analyzing, containing, investigating, and responding to cybersecurity incidents across the enterprise. The role involves coordinating incident response activities, conducting forensic investigations, analyzing security events, and working closely with internal stakeholders to minimize business impact while enhancing the organization's cyber resilience.

• Monitor and investigate security alerts generated by SIEM, EDR, IDS/IPS, firewalls, and other security tools.
• Perform cyber incident triage by determining severity, scope, urgency, and business impact.
• Lead technical investigations and coordinate incident response activities across multiple teams.
• Execute containment, eradication, and recovery activities during cyber incidents.
• Perform real-time incident handling, forensic evidence collection, malware analysis, and threat correlation.
• Collect and preserve digital evidence following forensic best practices.
• Analyze host, network, firewall, IDS/IPS, and application logs to identify attack patterns.
• Perform malware analysis and identify Indicators of Compromise (IOCs).
• Investigate compromised systems and recommend remediation measures.
• Maintain complete incident records from detection through closure.
• Prepare incident reports, executive summaries, and post-incident ("After Action") reports.
• Develop technical guidance, incident response playbooks, and standard operating procedures.
• Coordinate with Threat Intelligence teams to validate threats and enrich investigations.
• Monitor external threat intelligence feeds and emerging cyber threats.
• Recommend proactive improvements to security controls based on investigation findings.
• Collaborate with infrastructure, application, SOC, legal, and business teams during incidents.
• Support vendor evaluations and provide technical input into cybersecurity solutions.
• Participate in developing technical specifications, RFPs, and SLAs.

• Bachelor's degree in Computer Science, Cybersecurity, Information Security, Information Technology, Computer Engineering, or a related discipline.
• Minimum 10 years of experience in Cybersecurity, with at least 7 years specializing in Incident Response, Security Operations Center (SOC), or Cyber Defense.
• Proven experience in managing the complete Incident Response lifecycle, including preparation, detection, analysis, containment, eradication, recovery, and post-incident reviews.
• Hands-on experience with SIEM platforms such as Microsoft Sentinel, Splunk, IBM QRadar, Arc Sight, or equivalent for security monitoring, log analysis, and incident investigation.
• Strong expertise in Endpoint Detection and Response (EDR) solutions, including Microsoft Defender for Endpoint, Crowd Strike Falcon, Carbon Black, Sentinel One, or similar technologies.
• Experience conducting digital forensic investigations, evidence collection, malware analysis, and root cause analysis while maintaining forensic integrity and chain of custody.
• Solid understanding of cyber threat intelligence concepts, attacker tactics, techniques, and procedures (TTPs), with practical application of the MITRE ATT&CK Framework.
• Proficiency in analyzing security logs from multiple sources, including operating systems, applications, network devices, cloud platforms, and security appliances to identify Indicators of Compromise (IOCs).
• Working knowledge of scripting and automation using Power Shell, Python, or Bash to support investigations, automate repetitive tasks, and enhance incident response processes.
• Preferred
  
  Certifications:
  
  Security+, CEH, CISSP, GICSP, CCNA Security, or equivalent (not mandatory but an advantage).
• Strong analytical, problem-solving, and decision-making skills with the ability to perform effectively under pressure during critical cybersecurity incidents.
• Excellent communication, stakeholder management, and report-writing skills, with the ability to prepare technical investigation reports, executive summaries, and post-incident recommendations, while collaborating effectively with cross-functional teams and…