SOC Analyst L2/L3 and Incident Response

You detect, qualify and handle security incidents for end clients or a managed SOC. You are on the front line against threats, from alert triage to incident response, and you continuously improve detection capabilities.

Your responsibilities include: detecting, qualifying and handling security incidents, with the goal of protecting end clients or a managed SOC from threats. You monitor, triage and qualify alerts (SIEM, EDR, NDR, CTI). You lead investigations, including log analysis, event correlation and first-level forensics. You drive incident response through containment, eradication, recovery and lessons learned. You write incident reports and communications for the CISO and IT teams. You develop and tune detection rules and use cases (Sigma, KQL, SPL). You conduct threat hunting based on threat intelligence and the MITRE ATT&CK framework. You automate recurring tasks (SOAR, Python / PowerShell scripts). You write response playbooks and procedures. You take part in crisis exercises and simulations (purple team, tabletop).

Must-have: 3+ years in a SOC, CSIRT or incident response role. Hands-on experience with at least one SIEM (Microsoft Sentinel, Splunk, QRadar, Elastic) and one EDR (Defender, CrowdStrike, SentinelOne). Solid knowledge of MITRE ATT&CK and common attack techniques (ransomware, phishing, lateral movement). Ability to analyze Windows, Linux, network and cloud logs. Composure and clear communication in crisis situations.

Nice-to-have: Certifications: GCIH, GCFA, GCIA, BTL1, SC-200, CySA+, OSDA. Scripting: Python, PowerShell, KQL. Experience in forensics (memory, disk) and first-level malware analysis. Cloud environments: Azure, AWS, Microsoft 365. Knowledge of the Belgian framework: CCB, CERT.be, NIS2.

Languages: Fluent English required; French or Dutch is a plus.