# Cyber Security Incident Response Team (CSIRT) Officer **Company:** [MindWave](https://jobs.workable.com/companies/e6nZKCD4kFuyK7noxxwUsL.md) **Location:** Brussels, Belgium **Workplace:** hybrid **Employment type:** Contract **Department:** Belgium [Apply for this job](https://jobs.workable.com/view/a4b70f74-9d98-47df-89d6-38dc72fd0876) ## Description At MindWave, we’re not just building teams. We’re building a new way of working. We’re creating a community of experts who thrive in a transparent, human, and forward-thinking environment. We are currently looking for a **Cyber Security Incident Response Team (CSIRT) Officer** to join our community and support a major CISO Cybersecurity Center of Excellence team. In this role, you will contribute to daily security incident preparation, detection, and response activities—including threat detection, level 3/4 incident handling, forensic analysis, threat hunting, and SIEM engineering—while working closely with internal staff, affiliates, and external security service providers. ### Key Responsibilities 1\. Incident Handling & Level 3/4 Response - Investigate and respond adequately to Level 3/4 security incidents, including malware infections, network intrusions, and data breaches across IT, IoT, and OT environments. - Conduct forensic investigations, technical coordination, and deep-dive analysis of security incidents regardless of origin. - Work closely with SOC, CSIRT, and cross-functional internal teams to identify, mitigate, and remediate security risks. - Develop, refine, and implement incident response plans and procedures, providing guidance on security best practices across the organization. - Clearly communicate and report security incident progress, risks, and post-incident analysis to internal and external stakeholders. ### 2\. Threat Detection & Threat Hunting - Proactively identify threats and vulnerabilities across the organization's infrastructure using SIEM platforms and custom detection tools. - Conduct regular threat hunting exercises to detect potential threats that have evaded traditional security controls. - Collect and analyze security data and system artifacts (analyzing Windows, Linux, network, and security logs) to identify anomalous behavior and indicators of compromise (IOCs). - Collaborate closely with the 3rd party SOC team to investigate potential security incidents and provide technical guidance on threat remediation and mitigation strategies. ### 3\. SIEM Engineering & Automation - Develop, maintain, and optimize SIEM systems (e.g., Microsoft Sentinel) to ensure timely detection and rapid incident response. - Create, refine, and maintain custom detection rules and use cases aligned with the **MITRE ATT&CK** framework. - Author and maintain detailed playbooks for the SOC team to ensure standardized, consistent, and effective incident response. - Automate alert handling and response workflows for SIEM and EDR events to streamline security operations and allow the SOC/CSIRT to focus on high-priority threats. ### 4\. Projects, Exercises & Continuous Improvement - Organize, animate, and facilitate cybersecurity tabletop exercises to test organizational incident response readiness. - Contribute to security engineering projects based on team needs, such as deploying, maintaining, and integrating new security platforms or tools. - Script and automate manual operational tasks to enhance the team's efficiency and detection capabilities. ### Team Context You will join the CISO Cybersecurity Center of Excellence team within the enterprise CISO organization. You will collaborate closely with fellow CSIRT officers, internal IT/OT/IoT teams, the 3rd party Security Operations Center (SOC) team, organizational affiliates, and external security service providers. ## Requirements ### Conformity & Qualification Criteria - **Education:** Bachelor's degree in Computer Science, Information Security, a related field, or equivalent professional experience. - **Experience:** Minimum 4 years of professional experience in a security-related role, with a strong focus on incident response and technical security analysis. - **Tabletop Exercises:** Demonstrated experience in organizing, planning, and animating tabletop exercises. - **Certifications:** Relevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, GREM, or equivalent. - **Language Proficiency:** Spoken and written fluency in English (minimum C1 level). Working knowledge of Dutch (NL) or French (FR) is an asset. - **Location & Presence:** Hybrid setup with presence at the client office in Brussels ### Key Technical Competencies & Evaluation Assets - Strong analytical and problem-solving skills with the ability to identify and respond to security incidents in a timely, calm, and effective manner. - Hands-on experience with Incident Response tools and platforms (e.g., ServiceNow SIR module), forensics frameworks, and malware analysis. - Strong technical expertise in security technologies and ecosystem tools, such as Microsoft Sentinel SIEM, EDR solutions, Microsoft Defender suite, intrusion detection/prevention systems (IDS/IPS), and firewalls. - Practical experience in SOC/SIEM engineering, identifying gaps in detection coverage, writing MITRE ATT&CK-mapped use cases, and building automated playbooks. - Proven knowledge in security monitoring, digital forensics, threat intelligence, and log analysis (Windows, Linux, network devices). - Customer-focused mindset with the ability to handle security incidents in an organization-sensitive and diplomatic manner. - Working knowledge of French (FR) or Dutch (NL). ### 🌱 Soft Skills and MindWave Mindset At MindWave, we value people who are not only strong in what they do, but also in how they work with others. - **Autonomy & Ownership:** You take full ownership of security incidents and feel comfortable working with high autonomy. You stay calm under pressure, explore technical anomalies methodically, and turn analysis into concrete action plans. - **Pragmatism & Open Communication:** You combine technical thoroughness with a pragmatic approach to risk. You communicate openly when you identify security gaps, risks, or opportunities for automation. - **Curiosity & Knowledge Sharing:** Cybersecurity moves fast. You are naturally curious, eager to experiment with new threat hunting techniques or detection frameworks, and passionate about sharing knowledge with your peers. - **Transparency & Trust:** You value transparency, trust, and clear communication—especially during critical security incidents when clarity and human connection matter most. ## Benefits ### Why Join MindWave? - 🧠 **Community of Experts:** Natural and planned knowledge-sharing moments, such as brown bag sessions on AI, cybersecurity innovations, and emerging tech. - 🏝️ **Flexible Setup:** Balanced hybrid setup aligning client operational requirements with remote flexibility and strong community support. - 🚀 **Transparent & Human Culture:** A transparent working environment where you can grow, contribute, and be yourself. - 🌱 **Accessible Leadership:** Direct interaction and genuine involvement from leadership in the lives of our consultants and community. - 🌍 **High-Impact Project:** A long-term, technically challenging mission protecting critical enterprise infrastructure. - ⚖️ **Competitive Package:** Complete package for employees (medical insurance, meal vouchers, training budget, remote-work allowance) and full transparency on rates and fees for freelancers.