Incident Response Specialist

About the role

We are seeking an experienced L3 Incident Response professional with strong expertise in Microsoft Sentinel, Cloud Security, and Web Application attack remediation to join our cybersecurity team. The role leads detection, investigation, and response activities for complex security incidents across multi‑cloud and enterprise environments.

Key responsibilities

• Lead end‑to‑end response to cybersecurity incidents, including triage, containment, eradication, recovery, root‑cause analysis and post‑incident reviews.
• Investigate and remediate cloud security incidents such as compromised IAM roles, unauthorized resource creation, storage misconfigurations and container escapes.
• Respond to complex web‑application attacks (OWASP Top 10, API abuse, injection flaws, web shells) in coordination with application and DevOps teams.
• Conduct threat hunting and forensic investigations across endpoints, networks, identity systems and multi‑cloud platforms (Azure, AWS, GCP).
• Design, develop and optimise detection rules, analytics and automated playbooks in Microsoft Sentinel and cloud‑native security tools.
• Develop automation solutions using KQL, PowerShell, Python and SOAR technologies to improve detection and response efficiency.

Required profile

• 8–10 years of cybersecurity experience with 3–4 years dedicated to Incident Response.
• Deep hands‑on knowledge of cloud architectures (Azure, AWS, GCP), IAM, API activity logging and cloud forensics.
• Extensive experience configuring, tuning and managing Microsoft Sentinel, including advanced KQL queries and playbook development.
• Strong understanding of web‑application vulnerabilities, HTTP traffic analysis and WAF log interpretation.
• Proficiency with SIEM, SOAR, EDR and CSPM tools and familiarity with MITRE ATT&CK and MITRE ATT&CK for Cloud frameworks.
• Excellent analytical, problem‑solving and cross‑functional communication skills.

Required skills

• Microsoft Sentinel
• KQL (Kusto Query Language)
• PowerShell
• Python
• Azure, AWS, GCP
• SIEM, SOAR, EDR, CSPM
• Microsoft Defender for Cloud
• AWS CloudTrail, Azure Activity Logs
• MITRE ATT&CK & MITRE ATT&CK for Cloud