{"id":2518609,"url":"https://alion.io/job/schneider-electric-cybersecurity-incident-response-engineer","title":"Cybersecurity Incident Response Engineer","company":{"id":1266,"name":"Schneider Electric","domain":"se.com","url":"https://alion.io/company/schneider-electric","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Jibe","truth_index":{"grade":"B","score":75,"open_postings":96,"ghost_share":0,"stale_share":0.99,"repost_share":0,"time_to_fill_p50_days":29,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Barcelona, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":30000,"max_usd":85000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":528},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bash","optional":false},{"name":"DNS","optional":false},{"name":"Linux","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-14T10:25:10Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-19T01:08:20Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"We are your Energy Technology Partner. We electrify, automate, and digitalize every industry, business, and home, driving efficiency and sustainability for all.\nAt Schneider Electric, our values - IMPACT (Inclusion, Mastery, Purpose, Action, Curiosity, Teamwork) - are the foundation of everything we do. Becoming an Impact Maker means turning sustainability ambitions into actions at the intersection of automation, electrification, and digitization.\nAre you ready to lead the digital transformation to create a more sustainable world?\nIf you are up to challenge your creativity and make an impact, we are excited to welcome you!\nSchneider Digital is the digital department of Schneider Electric, leading the digital transformation in the company by giving support globally to our internal teams and our clients. Schneider Digital consists of 6 Digital Hubs worldwide which are strategically located to ensure a 24/7 support across the company (France, China, India, USA, Mexico and Spain). Our Digital Hub in Barcelona is formed by +450 employees working in strategic projects and different roles such as Data, Cybersecurity, ERP, Cloud, Infrastructures, IT Project Management or Digital Marketing.\nWe are looking for a Cybersecurity Incident Response Engineer to join the Enterprise IT Infrastructure Security team in Barcelona. The role focuses on cybersecurity incident response and supports the consistent handling of incidents impacting Enterprise IT.\nThe successful candidate will independently manage security incidents within the assigned regional scope, following established incident response processes and playbooks. The role requires sound technical analysis, disciplined case management, effective coordination with operational teams, and timely escalation when an incident exceeds the assigned scope or severity.\nRole Mission\nExecute the end-to-end incident response lifecycle for assigned cybersecurity incidents within one region.\nValidate alerts, determine incident scope and impact, coordinate containment and recovery actions, and document conclusions and evidence.\nApply approved playbooks and procedures consistently, adapting case tasks when required while escalating high-priority, global, or highly complex incidents to senior responders or incident owners.\nMaintain clear communication with technical teams, regional cybersecurity stakeholders, and affected business contacts throughout the investigation.\nWhat will you do?\nKey Responsibilities\nIncident Triage and Investigation\nReview security alerts and reported events to determine whether they represent a cybersecurity incident.\nAssess severity, affected assets, users, business scope, and potential impact using established classification criteria.\nCollect and analyze relevant evidence, including SIEM events, endpoint telemetry, identity and sign-in data, email artefacts, network logs, cloud activity, and indicators of compromise.\nDevelop and document an investigation timeline, working hypotheses, findings, and technical conclusions.\nEscalate promptly when evidence indicates high impact, cross-regional scope, legal or privacy implications, or the need for specialist forensic analysis.\nContainment, Eradication and Recovery\nCoordinate containment actions with SOC, endpoint, identity, messaging, network, cloud, infrastructure, and application teams.\nUse approved playbooks and response procedures to reduce exposure while preserving relevant evidence.\nTrack assigned remediation and recovery actions through completion and validate that agreed technical measures have been implemented.\nCase Management and Communication\nMaintain accurate and timely case records, including actions taken, evidence reviewed, decisions, owners, and status updates.\nProvide clear technical summaries for both technical and non-technical stakeholders in English.\nCoordinate with regional Digital Risk Leaders, CISOs, SOC, Cyber Defense, Infrastructure, Identity, Forensics, Threat Intelligence, Privacy, and other teams as required by the case.\nParticipate in handovers and operational reviews to support continuity of response across time zones.\nContribute factual input to post-incident reviews and lessons learned. Ownership of process redesign or strategic improvement initiatives is not a core expectation of this role.\nDetection and Technical Enablement\nUse SIEM, EDR, identity, network, cloud, email security, and case-management tools to investigate incidents.\nCreate or adapt basic hunting queries and scripts to collect, normalize, correlate, or summarize investigative data.\nUse approved automation and AI-assisted capabilities to improve the speed and consistency of analysis and reporting, under established governance and review controls.\nShare recurring operational observations with senior responders and detection or engineering teams for further assessment.\n What qualifications will make you successful?\nExperience and Education\nRequired\n2-4 years of professional experience in cybersecurity operations, incident response, SOC operations, infrastructure security, or a closely related discipline.\nHands-on experience investigating security events and coordinating technical response actions in an enterprise IT environment.\nTechnical background in computer science, information technology, cybersecurity, engineering, or a related discipline, or equivalent practical experience.\nAbility to manage assigned incidents with limited supervision while recognizing escalation thresholds and decision boundaries.\nWorking proficiency in English, both written and spoken.\nPreferred\nExperience with Microsoft security technologies, KQL, endpoint detection and response, cloud security monitoring, or identity investigation.\nExposure to case management, forensic triage, vulnerability management, threat intelligence, or phishing and account-compromise investigations.\nExperience with scripting, data analysis, APIs, or automation workflows.\nRelevant certifications such as GCIH, GCFA, Security+, SC-200, or equivalent are an advantage but are not mandatory.\nSoft Skills and Behaviors\nStructured, methodical, and accountable in case handling and evidence documentation.\nAble to remain calm, prioritize effectively, and make sound operational decisions during time-sensitive situations.\nClear communicator who can explain technical findings and required actions to different audiences.\nCollaborative team member who works effectively across regions, functions, and technical domains.\nCurious and analytical, with a willingness to learn from incidents and develop broader technical expertise.\nCareful with confidential information and committed to ethical evidence handling.\nComfortable receiving guidance from senior responders and escalating when a case exceeds the role scope.\nDesired Technical Skills\n\nSkill Area\nExpected Level\nDescription\nIncident Response\nIntermediate\nPractical knowledge of triage, analysis, containment, eradication, recovery, evidence gathering, escalation, and case closure.\nIncident Response Tools\nIntermediate\nAbility to use tools for incident detection, investigation, response coordination, forensic triage, and indicator analysis.\nSecurity Monitoring / SIEM\nIntermediate\nAbility to investigate alerts, correlate events, build basic queries, and reconstruct incident timelines.\nEndpoint Security / EDR\nIntermediate\nAbility to interpret endpoint alerts, process activity, persistence indicators, and host containment actions.\nIdentity and Access Security\nBeginner to Intermediate\nUnderstanding of account compromise, MFA abuse, privileged access, suspicious sign-ins, and session or token risks.\nNetwork Security\nBeginner to Intermediate\nUnderstanding of network protocols, firewalls, proxies, IDS/IPS, WAF, DNS, and network evidence used during investigations.\nWindows Administration\nIntermediate\nAbility to understand Windows environments, users, services, processes, event logs, and common security artefacts.\nLinux Administration\nBeginner to Intermediate\nUnderstanding of Linux operating-system concepts, logs, permissions, services, and command-line usage.\nCloud Security: Azure / AWS\nBeginner\nUnderstanding of cloud concepts, audit logs, identity controls, and common security services in Azure and AWS.\nVulnerability Management\nBeginner to Intermediate\nAbility to understand vulnerability impact, exploitability, affected scope, remediation status, and risk-based prioritization.\nThreat Intelligence\nBeginner\nAbility to interpret threat reporting and indicators in support of a specific investigation.\nDigital Forensics\nBeginner\nUnderstanding of evidence preservation, artefact review, chain of custody, and criteria for specialist escalation.\nCoding and Automation\nBeginner\nAbility to use Python, PowerShell, Bash, KQL, APIs, or similar tools for repeatable investigation and reporting tasks.\nAI-Assisted Security Operations\nBeginner\nUnderstanding of controlled use of AI tools for summarization, enrichment, and repetitive analytical tasks.\nWhat's in it for me?\nWe adapt to you:\nWith our flexible schedule, you'll have the freedom to adjust your work hours to accommodate your personal needs and responsibilities.\nWe know how great it is to work from home. With our hybrid work plan, you can enjoy working from the comfort of your home.\nNeed more time to relax and disconnect? With our Holy Pack, you can purchase additional vacation days to recharge when you need it most.\nCelebrate holidays your way! With Floating Holidays, you can exchange holidays for other days that better suit your plans and personal preferences.\nNeed additional time to explore new experiences or focus on personal projects? With the Sabbatical Pack, you can request up to 2 months of extra leave (unpaid).\nWe value the importance of family and want to support you in all aspects of your life. Our Global Family Leave Policy provides flexible paid conditions for when you need it most, whether you're about to be a parent, need time to overcome a loss, or to care for a loved one.\nWe take care of you:\nWith access to the health and wellness platform Wellwo, you and up to 5 people of your choice can enjoy access to wellness content, nutrition counseling, fitness classes, and more!\nFrom dance classes to booking a hotel spa, we offer an agreement with Wellhub so you can access a network of thousands of gyms and sports centers to keep your body active in the way you like best.\nYour well-being is our priority. You will have medical service at your workplace for close attention to any medical needs.\nWe empower you:\nWith Career Hub, our AI-driven professional development platform, you can connect with job opportunities, projects, and mentors at Schneider Electric globally.\nWe offer you the opportunity to be a shareholder of Schneider Electric and share in our achievements with our stock ownership program.\nWe celebrate everyone's talent and success with our recognition program, through which you can give and receive points for your achievements and redeem them for gift cards at your favorite stores.\nYou will have life insurance for your protection.\nWe offer you a Flexible Remuneration Plan in which you can choose from a variety of options, such as health insurance, meal vouchers, childcare vouchers, transportation vouchers, training, and more.\nWith Club Schneider, you will enjoy special discounts at your favorite stores, restaurants, travel agencies, and other external services.\nParticipate in company-subsidized volunteer programs to contribute to our community and have a positive impact on your environment.\nBring your cybersecurity expertise to a team that values your impact - apply today!\n Grade 6\n Looking to make an IMPACT with your career?\nWhen you are thinking about joining a new team, culture matters. At Schneider Electric, our values and behaviors are the foundation for creating a great culture to support business success. We believe that our IMPACT values - Inclusion, Mastery, Purpose, Action, Curiosity, Teamwork - starts with us.\nIMPACT is also your invitation to join...","description_format":"text","description_chars":14128,"description_truncated":true,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Flexible schedule","Health insurance","Hybrid work","Life insurance","Parental leave","Professional development"],"hiring_locations":[{"name":"Spain","iso":"ES","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response","Electrical Equipment & Cables"],"lifecycle":[{"event":"open","at":"2026-10-14T10:25:10Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":2,"expected_fill_days":29,"reasons":["conf:3","stale_co","velocity","win:early","comp:junior,brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/schneider-electric-cybersecurity-incident-response-engineer","json_url":"https://alion.io/job/schneider-electric-cybersecurity-incident-response-engineer.json","meta":{"generated_at":"2026-10-19T02:34:04Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1437,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1266},"rest":"https://alion.io/mcp/rest/get_company?id=1266"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fschneider-electric-cybersecurity-incident-response-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fschneider-electric-cybersecurity-incident-response-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fschneider-electric-cybersecurity-incident-response-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/schneider-electric-cybersecurity-incident-response-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fschneider-electric-cybersecurity-incident-response-engineer"}]}