{"id":3526767,"url":"https://alion.io/job/andersen-cybersecurity-incident-responder","title":"Cybersecurity Incident Responder","company":{"id":8912,"name":"Andersen","domain":"andersenlab.com","url":"https://alion.io/company/andersen-lab","size_band":null,"is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"HeadHunter","truth_index":{"grade":"A","score":85,"open_postings":10,"ghost_share":0.1,"stale_share":0,"repost_share":0.6,"time_to_fill_p50_days":30,"computed_at":"2026-11-01T06:10:25Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["Warsaw, Poland","Berlin, Germany","Poland"],"countries":["PL","DE"],"hiring_countries":["PL"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":37000,"max_usd":78000,"period":"year","method":"role_country_seniority_unknown","sample_n":159},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"EnCase","optional":false},{"name":"FTK","optional":false},{"name":"Incident Management","optional":false},{"name":"KAPE","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"SentinelOne","optional":false},{"name":"Velociraptor","optional":false},{"name":"Volatility","optional":false},{"name":"Windows","optional":false},{"name":"AWS","optional":true},{"name":"GCP","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-10-30T14:20:37Z","employer_posted_date":null,"last_verified_at":"2026-10-30T14:20:37Z","board_verified":false,"closed_at":null,"days_open":2,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":2},"description":"Andersen is hiring a Cybersecurity Incident Responder for a project protecting critical systems and managing security incidents in a complex international environment. \nThe customer is a large international organization that relies on modern technology and digital solutions to support its operations. Its activities involve secure IT infrastructure, data management, digital services, and the adoption of emerging technologies to improve operational efficiency and reliability. \nThe project is focused on providing cybersecurity and digital services for international organizations within a complex multi-tenant environment. It includes cyber defense operations, security incident management, and continuous protection of critical systems and services to ensure secure and reliable operations worldwide. \nResponsibilities: \nExecuting the full incident lifecycle: triage, containment, eradication, recovery and lessons learned. \n\nPerforming digital forensics on endpoints, servers and cloud workloads (disk, memory, logs). \n\nInvestigating escalated alerts from the SOC and determine the scope and impact of incidents. \n\nCoordinating response activities with affected client organizations, IT teams and management. \n\nDeveloping and maintaining IR playbooks and runbooks, and run tabletop exercises. \n\nWriting incident reports and rooting cause analyses, and recommend remediation. \n\nTaking part in on-call rotation (response within 15 minutes, system access within 1 hour). \n\nMust-haves: \nExperience in cybersecurity for 5+ years, including 3+ years in hands-on incident response. \n\nProven end-to-end handling of real incidents (e.g. ransomware, BEC, account compromise, data exfiltration). \n\nHands-on EDR/XDR experience (e.g. Microsoft Defender for Endpoint, CrowdStrike, SentinelOne). \n\nForensic tools and techniques: memory and disk analysis (e.g. Volatility, KAPE, Velociraptor, FTK/EnCase), Windows and Linux artifacts. \n\nInvestigation in Microsoft 365, Entra ID and Azure environments. \n\nStrong knowledge of NIST SP 800-61 or SANS incident handling frameworks. \n\nReadiness for on-call rotation. \n\nClean record, ready for background verification. \n\nLevel of English – from Upper-Intermediate and above. \n\nNice to haves: \nCertifications: GCIH, GCFA, GCFE, GNFA, ECIH. \n\nCloud forensics in AWS or GCP. \n\nMalware triage and basic reverse engineering. \n\nScripting in Python or PowerShell. \n\nExperience in a MSSP or a multi-tenant environment. \n\nReasons why this job would be interesting to you: \nExperience in teamwork with leaders in FinTech, Healthcare, Retail, Telecom, and others. Andersen cooperates with such businesses as Samsung, Siemens, Johnson & Johnson, BNP Paribas, Ryanair, Mercedes, TUI, Verivox, Allianz, T-Systems, etc.. \n\nThe opportunity to change the project and/or develop expertise in an interesting business domain. \n\nGuarantee of professional, financial, and career growth! The company has introduced systems of mentoring and adaptation for each new employee. \n\nThe opportunity to earn up to an additional 1,000 EUR per month, depending on the level of expertise, which will be included in the annual bonus, by participating in the company's activities. \n\nAccess to the corporate training portal, where the entire knowledge base of the company is collected and which is constantly updated. \n\nBright corporate life (parties / pizza days / PlayStation / fruits / coffee / snacks / movies). \n\nCertification compensation (AWS, PMP, etc). \n\nReferral program. \n\nPrivate health insurance and sports compensation, depending on the type of employment. \n\nYour personal data is protected in accordance with GDPR regulations. Learn more: https://andersenlab.com/privacy-policy/pl \nJoin us! \nTech stack\nIncident Response\nEDR/XDR\nEntra ID\nAzure\nNIST SP 800-61 or SANS","description_format":"text","description_chars":3776,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Health insurance"],"hiring_locations":[{"name":"Poland","iso":"PL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response","Software Testing & QA"],"lifecycle":[{"event":"open","at":"2026-10-30T14:25:00Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":30,"reasons":["seen:1","velocity","win:early"],"computed_at":"2026-11-01T06:10:25Z"},"pay":null,"html_url":"https://alion.io/job/andersen-cybersecurity-incident-responder","json_url":"https://alion.io/job/andersen-cybersecurity-incident-responder.json","meta":{"generated_at":"2026-11-02T04:55:27Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7055,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8912},"rest":"https://alion.io/mcp/rest/get_company?id=8912"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fandersen-cybersecurity-incident-responder"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fandersen-cybersecurity-incident-responder"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fandersen-cybersecurity-incident-responder"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/andersen-cybersecurity-incident-responder\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fandersen-cybersecurity-incident-responder"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3526767}},{"tool":"search_jobs","arguments":{"company":"andersenlab.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3526767},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}