Senior IT Security Engineer – Incident Response

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Act as the main liaison between the Americas IT Operations teams and the global Cyber Defense Center for managing security incidents.

• Oversee the triage, containment, eradication, recovery, escalation, and post-incident review processes for incidents impacting Americas IT assets.

• Direct the regional incident lifecycle from detection to closure, ensuring alignment with global protocols while addressing regional operational needs.

• Ensure timely, clear, and consistent communication with technical teams, regional stakeholders, senior management, and executive audiences.

• Acquire a comprehensive understanding of regional organizations, business units, technological environments, operational workflows, risks, and dependencies.

• Manage digital evidence in a forensically sound manner, upholding chain of custody, integrity, and documentation standards.

• Conduct security analysis and digital forensics across various environments, including Windows, Linux or UNIX, cloud, network, email, endpoint, and enterprise systems.

• Evaluate alerts, logs, threat intelligence, tickets, and reports from numerous sources, including SIEM and security operations platforms.

• Compile investigation findings, incident summaries, risk assessments, and post-incident reports for both technical and non-technical audiences.

• Track AI-driven attack methods and defensive strategies, such as deepfakes, automated phishing, adversarial machine learning, response automation, and AI-enhanced threat intelligence.

• Assist in the development of incident response playbooks, runbooks, standard operating procedures, tools, and initiatives for service enhancement.

• Provide mentorship to junior incident responders and disseminate knowledge across the regional security organization.

⛳️ Requirements

• Extensive expertise in cybersecurity incident response, security operations, incident coordination, containment, recovery, and post-incident analysis.

• Practical knowledge of digital forensics, evidence management, chain of custody, log analysis, threat intelligence, and investigative documentation.

• Familiarity with SIEM platforms, security monitoring tools, email and ticketing systems, and enterprise security operations processes.

• Comprehensive understanding of Windows, Linux or UNIX, directory services, AWS, Azure, mobile device management, virtualization, networks, web servers, databases, and firewalls.

• Proficient in at least one programming or scripting language, such as Python, PowerShell, or Bash.

• Insight into security control development, security operations, security risk management, and enterprise security governance.

• Awareness of AI and machine learning concepts related to cybersecurity threats, detection, response automation, and defensive technologies.

• Strong analytical, problem-solving, prioritization, and decision-making abilities during high-impact incidents.

• Exceptional written and verbal communication skills, with the capability to brief senior management and executive stakeholders.

• Ability to work collaboratively across organizational, cultural, and geographic boundaries.

• Fluent in English, both written and spoken.

• Proven track record of collaborating with international and multicultural teams.

• Over 8 years of professional experience in Information Technology, including a minimum of 6 years in cybersecurity, incident response, security operations, or a related field.

• Demonstrated experience in managing and coordinating security incidents within a matrixed, global, or multi-region organization.

• Experience working with or alongside a centralized Security Operations Center or Cyber Defense Center.

• Background in supporting incident response across multiple countries or regions, preferably within the Americas.

• Experience communicating incident statuses, risks, business impacts, and remediation steps to senior and executive stakeholders.

• Bachelor’s degree in Information Security, Computer Science, Information Systems, Business Administration, or a related field, or equivalent specialized training and professional experience.

🏝️ Benefits

• Fully remote working model.

• PJ (Pessoa Jurídica) contracting model.

• Flexible scheduling.

• Participation in incident response activities outside standard business hours may occasionally be required for significant security incidents or critical events.