Incident Responder Expert

Holcim builds progress for people and the planet. As a global leader in innovative and sustainable building solutions, Holcim is enabling greener cities, smarter infrastructure and improving living standards around the world. With sustainability at the core of its strategy, Holcim is becoming a net zero company, with its people and communities at the heart of its success. The company is driving the circular economy as a world leader in recycling to build more with less.

Holcim is the company behind some of the world’s most trusted brands in the building sector including ACC, Aggregate Industries, Disensa, Firestone Building Products, Geocycle, Holcim and Lafarge.

Americas Digital Center (ADC) is one of Holcim’s three global hubs driving digital transformation. As a strategic ally within our Global IT organization, our team of 400+ professionals enables global operations through expertise in Data Analytics, Cloud Computing, and Global Vendor Management.
We are part of Holcim, the world leader in sustainable building solutions. Together with 45,000 colleagues worldwide, we are on a mission to decarbonize construction and improve living standards through innovation.
As a certified Top Employer, we offer an exceptional environment where visionary talent thrives. We look for disruptive thinkers ready to embrace new challenges and shape the future of technology in a culture of continuous growth.

We are seeking a Cybersecurity Incident Response & DFIR Expert
. In this role, you will be fully responsible for internalizing and leading high-severity incident response and digital forensics capabilities tailored to the Americas time zone.

The position combines rigorous, hands‑on technical operations to mitigate critical threats (reactive phase) with designing cyber drills, implementing automations, and hardening response playbooks (proactive phase).

Incident Response (IR): Coordinate and lead the containment of critical cyber incidents (Ransomware, advanced intrusions), orchestrating technical teams and assigning tasks under high-pressure scenarios.

Digital Forensics (DF): Investigate the root cause, initial access vector, and scope of attacks through deep‑dive analysis of logs, system memory, networks, and endpoints.

Threat Intelligence & Reporting: Author comprehensive technical digital forensics reports, document lessons learned, and generate Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs).

Organizational Resilience: Design and execute cyber attack simulations (cyber drills) and develop technical incident response playbooks.

Strategic Communication: Translate complex technical findings into executive-level language to deliver clear briefings to crisis committees and senior leadership (C‑Level).

Education: Bachelor’s degree in Systems Engineering, Cybersecurity, Computer Science, or a related field.

Experience: Solid and proven track record in Blue Team, CSIRT, SOC Level 3 positions, or senior consulting roles specializing in DFIR.

Languages: Full professional fluency in English (both written and spoken) is an absolute requirement for global reporting and alignment.