incident response analyst

Trend Micro Inc.

<div><div>When you join Trend, you become part of a unique and diverse global family and you get to work towards a world safe for exchanging digital information.</div><div>
ABOUT TREND MICRO</div><div>
Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, Trend Micro's cybersecurity platform protects hundreds of thousands of organizations and millions of individuals across clouds, networks, devices, and endpoints. As a leader in cloud and enterprise cybersecurity, the platform delivers a powerful range of advanced threat defense techniques optimized for environments like AWS, Microsoft, and Google, and central visibility for better, faster detection and response. With 7,000 employees across 65 countries, Trend Micro enables organizations to simplify and secure their connected world. For additional information, visit <div>www.trendmicro.com</div></div><div></div><div>
POSITION OVERVIEW</div><div>
The Incident Response Analyst serves as the primary technical responder to active security incidents, interfacing with the Security Operations Center (SOC) and IT infrastructure teams, ensuring the effective containment, eradication, and recovery from cyber threats through rapid forensic analysis and technical mitigation.</div><div></div><div>
PRIMARY RESPONSIBILITIES</div><ul><li>
Oversee all incident response activities reported from detection to incident resolution.</li><li>
Serve as a contact point for suspicious and malicious events escalated by technical support cases, and from the Trend Micro threat hunting efforts and Incident Response Operations.</li><li>
Collect and preserve digital evidence for analysis using traditional DFIR and XDR methods.</li><li>
Analyze different digital forensic artifacts, network traffic, security events to perform root cause analysis and summarize all investigations and conclusions in an incident report.</li><li>
Differentiate between potential intrusion attempts and false alarms, evaluating unknown or suspicious activity and consulting on measures to mitigate their impact on availability and productivity.</li><li>
Review and analyze technical components of malware and other related threat activities in security-related events and different data sources to develop and refine detection criteria and generate threat intelligence.</li><li>
Compose security alert notifications and other communications.</li><li>
Stay up to date with current vulnerabilities, attacks, and countermeasures.</li><li>
Explain different threats to both technical and non-technical parties who do not necessarily have relevant backgrounds and provide consultancy on how to improve security posture to prevent relative threats.</li><li>
Threat Hunting in Telemetry for hidden, dormant threats, or potentially escalating threats</li><li>
Contribution in Detection Engineering in TM products based on Incident Reports or OSINT</li><li>
Occasional evening and weekend shifts may be required.</li></ul><div></div><div>
REQUIRED EXPERIENCE</div><ul><li>
A degree in a related field such as Digital Forensics, security, computer engineering, computer science, Telecommunication/Electronics engineering, Information Technology or equivalent professional certifications preferably GIAC/SANS (GEIR, GX-FA, and/or GCFA are a clear advantage)</li><li>
Eligible to work in Egypt and is ready to be resident in Cairo (or around it). Role is hybrid; employees may be asked to constantly work from the office a few days per week.</li><li>
3+ year experience in a full-time security position involving threat hunting, detection, Digital Forensic investigation and response.</li><li>
Sufficient knowledge of different security controls</li><li>
Sufficient Knowledge of common enterprise&rsquo;s IT infrastructure (Network and several types of OS)</li><li>
Sufficient knowledge on adversary Tactics, Techniques, and procedures and ability to map them to threat modeling frameworks</li><li>
Experience with log analysis, event correlation and incident management procedures and systems, and knowledge of host and network log sources.</li><li>
Experience with host-based digital forensics and threat hunting.</li><li>
Aptitude for learning, self-directed, and working in critical incidents.</li><li>
Must have a powerful sense of duty, diligent in investigation.</li><li>
Ease of communication to internal and external stakeholders in English and Arabic. Communication may include reports, presentations, verbal instant updates, or other forms of communication</li></ul><div></div><div>
PREFERRED EXPERIENCE</div><ul><li>
Total 5+ years of experience in a Cybersecurity/IT/technology relevant role in a structured environment</li><li>
Experience in a comparable vendor or a security service provider</li><li>
Experience in different types of cybersecurity related assessments</li><li>
Malware analysis and threat detection engineering</li><li>
Scripting capability</li><li>
Demonstrated knowledge of Offensive security</li><li>
Experience of Security architecture/controls</li><li>
Familiarity with Trend Micro products and technology</li><li>
A third language proficiency</li><li>
Customer/Executive interfacing experience</li></ul><div></div><div>
Trend Micro strive to build an environment of equity and inclusion, which reflects diverse points of view. We welcome, value, promote, and celebrate diversity - the very experiences and attributes that make us who we are, including but not limited to race, ethnicity, nationality, gender, gender identification, sexual orientation, level of ability, age, religion, veteran status, socio-economic status, and political philosophy.</div><div></div><div>
#LI-Onsite</div><div>
#LI-NA1</div><div></div><div>
We embrace change, empower people, and encourage innovation. Join Trend Micro and Thrive with us.</div></div>

Incident Response Analyst

Eventus Techsol

<div><div><div>Job Description</div><div><div>
Job Title: Security Analyst - L3

Experience: 5+ years

Location: Jeddah

Key Responsibility Areas &ndash; Security Analyst - L3 &ndash; SOC
<div>
<ul><li>Security Incident Leadership: Lead high-priority security investigations and incident response activities, ensuring accurate analysis, containment, remediation, and post-incident reporting.</li></ul>
<ul><li>Operational Oversight: Oversee day-to-day SOC operations, including shift handovers, escalation management, and ensuring continuity across a 24/7 environment with global customers.</li></ul>
<ul><li>Technical Expertise: Act as the escalation point for complex threats and security incidents requiring deep analysis of logs, packets, malware, and behavioral patterns using EDR, XDR, SIEM, and forensic tools.</li></ul>
<ul><li>Threat Detection and Hunting: Conduct proactive threat hunting using various data sources and tools. Create and optimize detection use-cases, correlation rules, and playbooks to enhance threat visibility and reduce dwell time.</li></ul>
<ul><li>Process &amp; Playbook Management: Develop, refine, and enforce standard operating procedures (SOPs), playbooks, and incident response workflows to drive consistent and measurable outcomes.</li></ul>
<ul><li>Customer Engagement: Interface with global stakeholders (especially US/Canada clients), providing clear incident briefings, RCA reports, and advisory support.</li></ul>
<ul><li>Collaboration and Mentorship: Mentor L1 and L2 analysts, conduct training sessions, and support skill development across shifts.</li></ul>
<ul><li>Continuous Improvement: Participate in tuning detection content, improving tool configurations, and supporting red/blue/purple team exercises to elevate SOC maturity.</li></ul>
<ul><li>Documentation and Reporting: Ensure high-quality documentation of incidents, processes, and technical findings. Contribute to executive and operational reporting.</li></ul>
</div></div></div></div><div></div><div><div><div>
Location</div><div><div>
Jeddah</div></div></div><div><div>
Experience</div><div><div>
5+ years</div></div></div><div><div>
Send Your CV To</div><div>
careers@eventussecurity.com</div></div></div></div>

Security Analyst - L3

Halan - حالا

<div>
 
 
 Job Summary:
 
 
 
 
 
 
 
 We are seeking a dedicated and detail-oriented SOC Analyst with 2-3 years of experience to join our Security Operations Center (SOC) team. The ideal candidate will be responsible for monitoring, detecting, and responding to security incidents to protect our organization&rsquo;s information assets.
 
 
 
 
 
 
 
 Key Responsibilities:
 
 
 
 
 
 <ul>
 
 <li>
 
 Monitor Security Alerts: Continuously monitor security alerts from SIEM solution and various security tools and systems.
 
 </li>
 
 <li>
 
 Incident Response: Investigate and respond to security incidents, including malware infections, unauthorized access, and other security breaches and act as the first responder to security incidents by analyzing, containing, and mitigating threats.
 
 </li>
 
 <li>
 
 Log Analysis: Analyze logs from SIEM solution including systems, firewalls, intrusion detection/prevention systems, and other security devices to identify potential threats.
 
 </li>
 
 <li>
 
 Coordinate and support the containment and eradication of security incidents. Provide guidance and support to other IT teams, Development teams and stakeholders on security incident response and remediation.
 
 </li>
 
 <li>
 
 Threat Intelligence: Stay updated on the latest threat landscape, including new vulnerabilities, exploits, and attack vectors, and apply threat intelligence to identify and mitigate potential security threats, security weaknesses and recommend actions.
 
 </li>
 
 <li>
 
 Ensure that security significant logs are available in SOC monitoring tools for analysis and investigation.
 
 </li>
 
 <li>
 
 Documentation: Maintain detailed documentation of security incidents, including the actions taken and the outcomes.
 
 </li>
 
 <li>
 
 Collaboration: Work closely with other IT and security teams to ensure a coordinated response to security incidents.
 
 </li>
 
 <li>
 
 Reporting: Prepare and present reports on security incidents and trends to management.
 
 </li>
 
 </ul>
 
 
 
 
 
 Requirments:
 
 
 
 
 
 <ul>
 
 <li>
 
 Bachelor&rsquo;s degree in computer science, Information Technology, Cybersecurity, or a related field.
 
 </li>
 
 <li>
 
 4+ years of experience in a SOC or similar security role.
 
 </li>
 
 <li>
 
 Relevant certifications such as CompTIA Security+, CEH, or equivalent are preferred.
 
 </li>
 
 <li>
 
 Proficiency with SIEM tools (e.g., FortiSIEM, Splunk, QRadar).
 
 </li>
 
 <li>
 
 Knowledge of network protocols and security technologies.
 
 </li>
 
 <li>
 
 Experience with incident response and handling.
 
 </li>
 
 <li>
 
 Familiarity with threat intelligence platforms and methodologies.
 
 </li>
 
 <li>
 
 Strong analytical and problem-solving skills.
 
 </li>
 
 <li>
 
 Excellent communication and teamwork abilities.
 
 </li>
 
 <li>
 
 Attention to detail and ability to work under pressure.
 
 </li>
 </ul>
</div>

SOC Analyst

Eventus Security Pvt. Ltd

We are seeking a dynamic and experienced cybersecurity professional to join our Security Operations Center (SOC) team. If you're a Saudi national passionate about cybersecurity, incident response, and threat intelligence, this is your opportunity to make a national impact.Location: Saudi Arabia Position: Senior Security Analyst Preference: Saudi nationals Department: Security Operations Center (SOC)Key Responsibilities<ul><li>Monitor and analyze security technologies such as IDS/IPS, Firewalls, VPNs, and Switches.</li><li>Investigate and respond to security incidents using SIEM and XDR tools.</li><li>Develop and implement incident response procedures within defined SLAs.</li><li>Perform threat hunting, forensic log analysis, and generate quality security reports.</li><li>Work closely with internal teams and clients to resolve and document incidents.</li><li>Mentor junior analysts and contribute to team knowledge-sharing.</li><li>Create and maintain technical documentation and threat intelligence reports.</li><li>Develop SIEM content, drive automation (SOAR), and contribute to continuous improvement.</li><li>Engage in on-site incident response activities when needed.</li></ul>Qualifications &amp; Skills<ul><li>Minimum 4+ years of cybersecurity experience.</li><li>Bachelor&rsquo;s or Master&rsquo;s degree in Cybersecurity, IT Security, or a related field.</li><li>Hands-on experience with XDR, SIEM platforms (Splunk, ArcSight, QRadar, LogRhythm), and incident handling.</li><li>Strong understanding of MITRE ATT&amp;CK, Cyber Kill Chain, and network protocols (TCP/IP).</li><li>Preferred certifications: OSCP, CISSP, CCIE, GCIH, GCIA, etc.</li><li>Ability to analyze and interpret logs from various system and security sources.</li><li>Fluent in English; Arabic is a plus.</li><li>Strong communication, leadership, and mentoring abilities.</li></ul>Why Join Us?<ul><li>Be a part of a critical national SOC team protecting vital infrastructure and enterprise networks.</li><li>Work with advanced threat detection tools and contribute to real-time security defense.</li><li>Collaborate with top-tier cybersecurity professionals and grow in a high-impact environment.</li></ul>Interested candidates (Saudis preferred) can apply now or send their CV to [alisha.mulla@eventussecurity.com] with the subject line:Application &ndash; Senior Security Analyst &ndash; Saudi ArabiaJob Type: Full-timePay: From &#65020;5,000.00 per monthApplication Question(s):<ul><li>Current Salary per month in SAR</li><li>Expected Salary per month in SAR</li><li>Nationality</li><li>Notice Period</li><li>Current Location</li></ul>Experience:<ul><li>SOC: 3 years (Required)</li></ul>Location:<ul><li>Jeddah (Required)</li></ul>

Senior Security Analyst

<div>Title: Cyber Security Analyst
 
Work Location: Bangalore
Work schedule: Rotational (2 days weekly off per week)
Mode: Hybrid
Job Summary:
We are seeking a skilled and proactive Cyber Security Analyst to join our cybersecurity team. The Analyst will be responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents in real-time. This role involves working with advanced security tools, conducting initial triage, escalating threats, and helping to ensure the overall security of the organization's digital assets. 
Key Responsibilities:
<ul><li>Monitor SIEM dashboards, alerts, and security logs to detect suspicious activities or policy violations.
</li><li>Perform initial triage, investigation, and classification of security incidents.
</li><li>Respond to alerts and incidents following defined incident response procedures.
</li><li>Analyze data from firewalls, IDS/IPS, endpoint protection, email security, and threat intelligence platforms.
</li><li>Escalate critical incidents to Team Lead or incident response teams.
</li><li>Create and maintain incident tickets with detailed findings and actions taken.
</li><li>Contribute to the continuous improvement of SOC processes, use cases, and playbooks.
</li><li>Assist in threat hunting and proactive identification of anomalies across the network.
</li>Generate regular and ad hoc reports on SOC metrics, incident trends, and findings. 
<li>
</li></ul>Required Skills and Qualifications:
<ul><li>Bachelor&rsquo;s degree in Computer Science, Information Security, or related field (or equivalent experience).
</li><li>2 to 4 years of experience in cybersecurity or SOC operations &amp; Monitoring.
</li><li>Understanding of cybersecurity principles, attack vectors, and threat detection.
</li><li>Experience with SIEM platforms (e.g., Splunk, QRadar, Palo Alto Cortex XSIAM, etc.).
</li><li>Familiarity with common security tools (EDR, IDS/IPS, vulnerability scanners).
</li><li>Strong analytical and problem-solving skills.
</li><li>Good communication skills and ability to work in a fast-paced team environment.
</li>Knowledge of MITRE ATT&amp;CK framework, TCP/IP, DNS, HTTP, and other protocols. 
<li>
</li></ul>Preferred Qualifications (Nice to Have):
<ul><li>Industry certifications: Security+ , CEH , GCIA , GCIH , Palo Alto Certified , or similar.
</li>Experience with scripting (Python, PowerShell) or automation (SOAR platforms). 
<li>
</li></ul>Shift and Work Environment:
<ul><li>Shift work including nights, weekends, and holidays (24/7 coverage).
</li><li>On-call rotation may apply.
</li>2 days weekly off per week. 
<li>
</li></ul>Hands-On Knowledge on below mentioned tools is good to have.
<div><ul><li>Palo Alto XSIAM / Cortex XDR
</li></ul><ul><li>Recorded Future
</li></ul><ul><li>Microsoft Defender / O365 Email DLP
</li></ul><ul><li>Proofpoint SEG
</li></ul><ul><li>Zscaler ZIA / ZPA
</li></ul><ul><li>Azure Active Directory / M365
</li></ul><ul><li>Intune / SCCM
</li></ul><ul><li>Virus Total / CISA / CIS Benchmarking</li></ul></div></div>

Cyber Security Analyst

Paramount Assure

<div> L2 SOC Analyst Compromise Assessment &amp; Incident Response (with SIEM Admin Knowledge) Role Overview: We are seeking a skilled L2 Security Analyst to support our MSSP operations team. The ideal candidate will possess a solid background in incident response and compromise assessment, as well as administration skills across various security platforms. You will work with enterprise clients to identify threats, perform in-depth investigations, and ensure platform reliability. Location: Onsite Key Responsibilities: Security Monitoring &amp; Incident Handling Analyze alerts from SIEM/EDR and perform triage to validate incidents. Provide containment and eradication support in real-time. Correlate logs and conduct root cause analysis using various telemetry sources. Compromise Assessment &amp; Generate IR reports, dashboards, and executive summaries. Lead endpoint and network-based compromise assessments for clients. Administrative &amp; Platform Support and maintain the health of SIEM, EDR, and firewall integrations. Troubleshoot ingestion issues and optimize detection logic. Ensure secure onboarding of log sources via APIs or agent-based collectors. Threat Intel &amp; Document IOCs and provide actionable recommendations. Requirements: Technical Expertise, 5 7 years of experience in SOC/IR roles. Strong command of MITRE ATT&amp;CK, Windows/Linux logs, and AD attacks. Proficient with SIEMs (QRadar, ELK, Sentinel), and forensic/packet tools. Familiarity with scripting (PowerShell/Python). Administrative Knowledge &amp; Experience managing SIEM infrastructure. Understanding of firewall policies, email security, and cloud logs. Ability to configure connectors, fine-tune rules, and automate integrations.</div>

SOC L2

help AG

<div>Help AG is looking for a talented and experienced Incident Response and Forensic Investigation Specialist (U.A.E National) who will be responsible for off-site and on-site Incident Response activities and customer engagements, leveraging multiple security technologies, guiding and leading customers in the handling of Security Incidents and examining IT and security systems using best-practice digital forensic methods to detect, validate and mitigate IT security related incidents. He / She will join our Cyber Defence team within our Managed Security Services (MSS) business unit. If you have a strong knowledge and interest in incident response and/or digital forensics, this position might be the right one for you. 
Responsibilities:<ul><li>
Lead incident response engagements in unknown environments until all threats are remediated.</li><li>
Develop custom incident response plans tied to specific environments and customer situations.</li><li>
Examinate and analyse logs/data from a broad variety of security technologies, such as Antiviruses, IDS/IPS, Firewalls, Switches, VPNs and other security threat data sources.</li><li>
Perform forensic analysis of different artifacts including RAM, packet captures, logs and disk images.</li><li>
Reverse engineer malicious software and develop signatures and indicators of compromise.</li><li>
Actively develop incident response tools, scripts, and various detection content.</li><li>
Research Red Team techniques, develop custom detection queries, rules, watchlists and other content, and conduct threat hunts.</li><li>
Articulate and execute common Incident Response methods (e.g. SANS).</li><li>
Respond to inbound requests via phone and other electronic means for technical assistance with managed services.</li><li>
Work on-site as required with clients during Live Security Incidents.</li><li>
Maintain a high degree of awareness of the current threat landscape.</li><li>
Champion excellence and support others in delivering it through active knowledge sharing with team members, writing technical articles for internal knowledge bases, blog posts and reports as required or requested.</li><li>
Create and present customer reports to ensure quality, accuracy and value to the client.</li><li>
Educate and train other Analysts in execution of Incident Response processes and forensic analysis techniques.</li><li>
Perform other essential duties as assigned.</li></ul> 
Qualifications &amp; Skills:<ul><li>
A Degree in Computer Science, Information Systems, Electrical Engineering or a closely related degree.</li><li>
7+ years of experience in information security, in areas such as security operations, intrusion detection, incident analysis, incident handling, log analysis, malware analysis, reverse engineering or threat detection.</li><li>
At least 2-3 years of experience as a Senior or Lead Analyst, or equivalent experience guiding, mentoring and teaching other Analysts/Security Professionals how to handle Security Incidents.</li><li>
Strong background or equivalent experience in four of the following: Security Threat and Event Analysis, Network Security Operations or Engineering, Reverse Engineering, Malware Analysis, Windows/Linux/OSX Forensics, Penetration Testing, Active Directory and Azure Administration.</li><li>
Demonstrate experience in handling Incident Response engagements (APTs and Ransomware) using the SANS Incident Response method (or similar).</li><li>
Should have at least one of the below ACTIVE certifications as a mandatory requirement:</li></ul>
CREST Certified Registered Intrusion Analyst (CRIA) 
GIAC Cloud Forensics Responder (GCFR) 
GIAC Certified Forensic Analyst (GCFA)
CREST Certified Host Intrusion Analyst (CC-HIA) 
CREST Certified Network Intrusion Analyst (CC-NIA)
CREST Certified Incident Manager (CC-IM)
CREST Certified Threat Intelligence Manager (CC-TIM) 
GIAC Reverse Engineering Malware (GREM)<ul><li>
CISSP, GCIA, GCIH, GCFE, OSCP certification would be preferable.</li><li>
Deep TCP/IP knowledge, networking and security product experience.</li></ul><ul><li>
Strong knowledge of Red Team tactics and ability to find adversary traces on Enterprise scale.</li><li>
Rapid development in scripting languages: Python/PowerShell /Bash.</li><li>
A sound knowledge of IT security best practices, common attack types and detection/prevention methods.</li><li>
Demonstrable experience in accountability for and applying the methods of Incident Response, including adherence to process and direct engagement with stakeholders.</li><li>
Demonstrable experience in analysing and interpreting system, security and application logs.</li><li>
Broad knowledge of the type of events that Firewalls, IDS/IPS and other security related devices produce.</li><li>
Demonstrable experience in the use of Digital Forensics tools, techniques and concepts including creating and using custom tools and scripts.</li><li>
Static reverse engineering and analysis of malware written in different languages (X86/X64/C/C#, Go, etc.), signatures and Yara/Snort/Sigma rules development.</li><li>
Knowledge of attack activities, such as scans, man in the middle, sniffing, DoS, DDoS, etc. and possible abnormal activities, such as worms, Trojans, viruses, etc.</li></ul>
Benefits:<ul><li> 
Health insurance with one of the leading global providers for medical insurance.</li><li>
Career progression and growth through challenging projects and work.</li><li>
Employee engagement and wellness campaigns activities throughout the year.</li><li>
Excellent learning and development opportunities.</li><li>
Inclusive and diverse working environment.</li><li>
Flexible/Hybrid working environment.</li><li>
Open door policy.</li></ul> 
About Us: 
Help AG is the cybersecurity arm of e&amp; enterprise (formerly Etisalat Digital) and provides leading enterprise businesses and governments across the Middle East with strategic consultancy combined with tailored information security services and solutions that address their diverse requirements, enabling them to evolve securely with a competitive edge.
Present in the Middle East since 2004, Help AG was strategically acquired by e&amp; (formerly Etisalat Group) in Feb 2020, hence creating a cybersecurity and digital transformation powerhouse in the region.
Help AG has firmly established itself as the region's trusted IT security advisor by remaining vendor-agnostic, trustworthy, independent, and cybersecurity focused. With best-of-breed technologies from industry-leading vendor partners, expertly qualified service delivery teams and a state-of-the-art consulting practice, Help AG delivers unmatched value to its customers by strengthening their cyber defenses and safeguarding their business.</div>

Incident Response and Forensic Investigation Specialist (DFIR) (U.A.E National)

Search 6177+ Incident response analyst jobs near you this October. New roles added regularly across leading industries. Apply today.