{"id":4018037,"url":"https://alion.io/job/litit-incident-response-analyst","title":"INCIDENT RESPONSE ANALYST","company":{"id":678787,"name":"LITIT","domain":"litit.tech","url":"https://alion.io/company/litit","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Recruitee","truth_index":{"grade":"B","score":75,"open_postings":3,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":34,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Vilnius, Lithuania"],"countries":["LT"],"hiring_countries":["LT"],"hiring_countries_total":1,"salary":{"min":3500,"max":5200,"currency":"EUR","period":"month","gross":null,"usd_annual":69924},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"DLP","optional":false},{"name":"IAM","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Windows","optional":false},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-11-10T11:11:53Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-10T18:54:51Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"ABOUT THE COMPANY\nLITIT, a joint venture between NTT DATA and Reiz Tech, is a company with deep-rooted industry know-how, dedicated to innovation within the IT sector. Its primary focus is delivering high-quality solutions in the DACH region. With a commitment to excellence, LITIT combines the best of German precision, Japanese work ethics, and Lithuanian talent to provide unparalleled IT service and support to its clients.\nABOUT THE ROLE\nAs a Cyber Security Incident Response Analyst, you will be responsible for detecting, investigating, and responding to cyber security incidents across enterprise environments. You will work across the full incident lifecycle - from initial alert and triage through investigation, containment, recovery, and post-incident review. The role has a strong focus on the Microsoft security ecosystem, including Microsoft Sentinel, Defender XDR, Defender for Endpoint, Microsoft Entra ID, Microsoft 365, and Azure. You will also work closely with Cloud, Infrastructure, IAM, Risk, Compliance, and other technical teams to coordinate incident response activities and continuously improve security detection and response capabilities.\nRESPONSIBILITIES\nMonitor and investigate security alerts using Microsoft Sentinel and Microsoft Defender technologies.\n\nTriage incidents and determine severity, scope, impact, and required response actions.\n\nInvestigate phishing, malware, compromised accounts, suspicious authentication, data loss, and unauthorised access.\n\nPerform endpoint, identity, Microsoft 365, Azure, email, and network investigations.\n\nCollect and analyse security logs, endpoint artefacts, authentication data, and network telemetry.\n\nIdentify indicators of compromise (IOCs) and attacker techniques.\n\nMap attacker activity to MITRE ATT&CK where relevant.\n\nCoordinate containment, eradication, and recovery activities with technical teams.\n\nPerform threat hunting based on observed attacker behaviour and threat intelligence.\n\nDevelop and tune Microsoft Sentinel queries, analytics rules, and detection use cases.\n\nImprove existing detections and reduce false positives.\n\nIdentify logging, telemetry, and security control gaps discovered during incidents.\n\nMaintain incident timelines, evidence, investigation records, and response actions.\n\nSupport root cause analysis and post-incident reviews.\n\nProduce clear technical reports and management-level incident updates.\n\nContribute to incident response playbooks, procedures, and cyber security exercises.\n\nREQUIREMENTS\nPractical experience in SOC, Cyber Security Incident Response, or a similar security operations role.\n\nStrong hands-on experience with Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Endpoint.\n\nExperience investigating Microsoft Entra ID identity and authentication activity.\n\nExperience investigating security incidents across Microsoft 365 and Azure environments.\n\nUnderstanding of Microsoft Defender for Identity and Microsoft Defender for Cloud.\n\nStrong KQL skills for security investigations, threat hunting, and detection development.\n\nExperience analysing Windows endpoint and security logs, with working knowledge of Linux security and log analysis.\n\nGood understanding of network security, traffic analysis, and packet captures.\n\nUnderstanding of IAM, endpoint security, email security, vulnerability management, and DLP.\n\nStrong understanding of the complete incident response lifecycle, including containment, eradication, recovery, and post-incident review.\n\nKnowledge of MITRE ATT&CK, Cyber Kill Chain, and NIST incident response practices.\n\nUnderstanding of forensic evidence handling and chain of custody principles.\n\nStrong analytical and troubleshooting skills with the ability to independently investigate complex security incidents.\n\nAbility to prioritise and make decisions during active incidents.\n\nStrong communication skills and the ability to explain technical findings clearly to both technical and non-technical stakeholders.\n\nWillingness and readiness to travel as required by project or client needs is expected. This may include occasional domestic or international travel, sometimes on short notice.\n\nNICE TO HAVE:\nPowerShell or Python scripting and security automation experience.\n\nExperience with Microsoft security detection engineering, threat hunting, or SOAR.\n\nDigital forensics or malware analysis experience.\n\nExperience with Microsoft Purview security or DLP capabilities.\n\nExperience working in banking, financial services, or another regulated environment.\n\nExperience supporting major or high-severity security incidents.\n\nRelevant certifications such as Microsoft SC-200, GCIH, GCIA, GCFA, CySA+, CISSP, or equivalent.\n\nWHAT WE OFFER\nSalary range: €3500 - €5200 (GROSS) / month.\n\nLearning opportunities with compensated certificates, learning lunches, and language lessons.\n\nChance to switch projects after one year.\n\nTeam building twice a year.\n\nOffice in Vilnius, Lithuania that offers themed lunches and a pet-friendly environment.\n\nRemote work opportunities.\n\nFlexible time off depending on a project.\n\nSeasonal activities with colleagues.\n\nAdditional health insurance and loyalty days for Lithuanian residents.\n\nReferral bonuses.\n\nRecognition of important occasions of your life.","description_format":"text","description_chars":5263,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible time off","Health insurance"],"hiring_locations":[{"name":"Lithuania","iso":"LT","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","IT Outsourcing & Dedicated Teams"],"lifecycle":[{"event":"open","at":"2026-11-10T13:49:28Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":34,"reasons":["conf:4","win:early"],"computed_at":"2026-11-10T23:48:15Z"},"pay":{"stated_usd_annual":69924,"is_top_pay":false},"html_url":"https://alion.io/job/litit-incident-response-analyst","json_url":"https://alion.io/job/litit-incident-response-analyst.json","meta":{"generated_at":"2026-11-10T23:48:15Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":110,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":678787},"rest":"https://alion.io/mcp/rest/get_company?id=678787"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flitit-incident-response-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flitit-incident-response-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flitit-incident-response-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/litit-incident-response-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flitit-incident-response-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4018037}},{"tool":"search_jobs","arguments":{"company":"litit.tech","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4018037},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}