{"id":4199315,"url":"https://alion.io/job/keep-simple-senior-it-security-engineer-incident-response","title":"Senior IT Security Engineer - Incident Response","company":{"id":2593999,"name":"Keep Simple","domain":"keepsimple.io","url":"https://alion.io/company/keepsimple","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Gupy","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Brazil"],"countries":["BR"],"hiring_countries":["BR"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bash","optional":false},{"name":"Incident Management","optional":false},{"name":"Linux","optional":false},{"name":"Machine Learning","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Unix","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-11-12T16:43:59Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-12T21:39:32Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Come work for a large global financial and insurance products company! This is your chance !!\nStart a successful career in a renowned company in the international market! Great opportunity!\nGlobal insurance and asset management company seeks a responsible, organized, dynamic and team-oriented person.\nResponsabilidades e atribuições\nWe are looking for a Senior IT Security Engineer specializing in Incident Response to serve as the primary liaison between Americas IT Operations teams and the global Cyber Defense Center.\nThe role coordinates the full security incident lifecycle across the region, combining global response standards with local operational context. The engineer will lead incident triage, containment, recovery, forensic analysis, stakeholder communication, and continuous improvement while strengthening regional readiness for traditional and AI-enabled cyber threats.\nKey Responsibilities:\nServe as the primary point of contact between Americas IT Operations teams and the global Cyber Defense Center for security incident management activities;\nCoordinate incident triage, containment, eradication, recovery, escalation, and post-incident review for events affecting Americas IT assets;\nManage the regional incident lifecycle from detection through closure, ensuring alignment with global processes and addressing regional operational gaps;\nMaintain timely, clear, and consistent communication with technical teams, regional stakeholders, senior management, and executive audiences;\nDevelop a detailed understanding of regional organizations, business units, technology environments, operational workflows, risks, and dependencies;\nHandle digital evidence in a forensically sound manner, preserving chain of custody, integrity, and documentation standards;\nPerform security analysis and digital forensics across Windows, Linux or UNIX, cloud, network, email, endpoint, and enterprise environments;\nAnalyze alerts, logs, threat intelligence, tickets, and reports from multiple sources, including SIEM and security operations platforms;\nPrepare investigation findings, incident briefings, risk assessments, and post-incident reports for technical and non-technical audiences;\nMonitor AI-enabled attack techniques and defensive capabilities, including deepfakes, automated phishing, adversarial machine learning, response automation, and AI-assisted threat intelligence;\nContribute to incident response playbooks, runbooks, standard operating procedures, tooling, and service improvement initiatives;\nMentor junior incident responders and share expertise across the regional security organization.\nRequisitos e qualificações\nRequired Qualifications / Skills:\nStrong expertise in cybersecurity incident response, security operations, incident coordination, containment, recovery, and post-incident analysis;\nHands-on knowledge of digital forensics, evidence handling, chain of custody, log analysis, threat intelligence, and investigative documentation;\nExperience with SIEM platforms, security monitoring tools, email and ticketing systems, and enterprise security operations workflows;\nBroad knowledge of enterprise technologies, including Windows, Linux or UNIX, directory services, AWS, Azure, mobile device management, virtualization, networks, web servers, databases, and firewalls;\nProficiency in at least one programming or scripting language, such as Python, PowerShell, or Bash;\nUnderstanding of security control development, security operations, security risk management, and enterprise security governance;\nFamiliarity with AI and machine learning concepts as they relate to cybersecurity threats, detection, response automation, and defensive technologies;\nStrong analytical thinking, problem-solving, prioritization, and decision-making skills during high-impact incidents;\nExcellent written and verbal communication skills, including the ability to brief senior management and executive stakeholders;\nAbility to collaborate effectively across organizational, cultural, and geographic boundaries;\nFluent English, both written and spoken;\nProven experience collaborating with international and multicultural teams.\nExperience Requirements:\n8+ years of professional experience in Information Technology, including at least 6 years in cybersecurity, incident response, security operations, or a closely related discipline;\nDemonstrated experience managing and coordinating security incidents in a matrixed, global, or multi-region organization;\nExperience working with or alongside a centralized Security Operations Center or Cyber Defense Center;\nExperience supporting incident response across multiple countries or regions, preferably within the Americas;\nExperience communicating incident status, risk, business impact, and remediation actions to senior and executive stakeholders.\nEducation:\nBachelor's degree in Information Security, Computer Science, Information Systems, Business Administration, or a related field, or equivalent specialized training and professional experience.\nPreferred Qualifications:\nCISSP, GCIH or another GIAC certification, CISA, CISM, CompTIA CySA+, or equivalent cybersecurity certification;\nExperience with cloud incident response and cloud-native security tools in AWS or Azure environments;\nKnowledge of enterprise security governance frameworks and global information security policies;\nUnderstanding of Americas privacy and regulatory requirements, including Brazil's LGPD, relevant US state privacy laws, and Canadian privacy regulations;\nRelevant AI or machine learning security training or certification;\nSpanish or Portuguese language capability in addition to English.\nWorking Model & Collaboration:\nBrazil based role with a 100% remote working model;\nClose collaboration with the global Cyber Defense Center, Americas IT Operations teams, regional business stakeholders, and leadership across North and South America;\nSchedule flexibility and participation in incident response activities outside standard business hours may occasionally be required for major security incidents or critical events.\nInformações adicionais\nModelo de contratação:\nPJ.\nForma de atuação:\n100% Remoto.","description_format":"text","description_chars":6153,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"Portuguese","level":"All levels","optional":true},{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Brazil","iso":"BR","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Personal Development","Coaching & Mentoring"],"lifecycle":[{"event":"open","at":"2026-11-12T21:39:32Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":33,"reasons":["conf:2","win:early"],"computed_at":"2026-11-12T23:55:11Z"},"pay":null,"html_url":"https://alion.io/job/keep-simple-senior-it-security-engineer-incident-response","json_url":"https://alion.io/job/keep-simple-senior-it-security-engineer-incident-response.json","meta":{"generated_at":"2026-11-12T23:55:11Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":50532,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2593999},"rest":"https://alion.io/mcp/rest/get_company?id=2593999"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkeep-simple-senior-it-security-engineer-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkeep-simple-senior-it-security-engineer-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkeep-simple-senior-it-security-engineer-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/keep-simple-senior-it-security-engineer-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkeep-simple-senior-it-security-engineer-incident-response"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4199315}},{"tool":"search_jobs","arguments":{"company":"keepsimple.io","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4199315},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}