{"id":933313,"url":"https://alion.io/job/softswiss-incident-response-analyst","title":"Incident Response Analyst","company":{"id":8389,"name":"SOFTSWISS","domain":"softswiss.com","url":"https://alion.io/company/softswiss","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Teamtailor","truth_index":{"grade":"B","score":83,"open_postings":3,"ghost_share":0,"stale_share":0.667,"repost_share":0,"time_to_fill_p50_days":38,"computed_at":"2026-11-08T05:47:12Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Tbilisi, Georgia"],"countries":["GE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Any.run","optional":false},{"name":"Bash","optional":false},{"name":"ClickHouse","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"Linux","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Splunk","optional":false},{"name":"SQL","optional":false},{"name":"VirusTotal","optional":false},{"name":"Windows","optional":false},{"name":"Ansible","optional":true},{"name":"Apache Kafka","optional":true},{"name":"CI/CD","optional":true},{"name":"Docker","optional":true},{"name":"Graylog","optional":true},{"name":"Kubernetes","optional":true},{"name":"Red Teaming","optional":true},{"name":"SIEM","optional":true},{"name":"Sysmon","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-09-15T12:24:37Z","employer_posted_date":"2026-09-15","last_verified_at":"2026-11-08T17:21:57Z","board_verified":true,"closed_at":null,"days_open":54,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":54},"description":"Overview:\nSOFTSWISS is looking for an Incident Response Analyst to join our on-call incident response team. In this role, you will respond to and investigate security incidents across the company, coordinate incident response with relevant teams, and help ensure timely and effective resolution of incidents .\nKey responsibilities:\nParticipation in security incident response\n\nPerforming basic primary incident response measures/triage\n\nExecution (and monitoring of execution) of tasks assigned based on planning results\n\nDevelopment and updating of playbooks for alert verification\n\nMonitoring alerts in compliance with SLA\n\nSubmitting proposals for optimizing tools and processes used\n\nThe position operates on a 2-on-2-off shift pattern, encompassing a 12-hour day shift, a 12-hour night shift the next day, and 2 free days after that\n\nRequired Experience:\nBasic indicator of compromise (IoC) analysis skills using publicly available tools (VirusTotal, AnyRun, etc.)\n\nExperience working with Splunk/Clickhouse/SQL at the level of writing simple search queries and interpreting results\n\nExperience working with SOAR/IRP\n\nGeneral understanding of current cyber threats and main attack methods\n\nBasic programming skills in Python, PowerShell, or Bash for automating routine tasks\n\nKnowledge of operating systems (Linux/Windows) at a junior system administrator level\n\nUnderstanding of the MITRE ATT&CK framework and Cyber Kill Chain\n\nAbility to analyze and process large volumes of data, including logs and triage\n\nStrong communication and teamwork skills: able to clearly articulate thoughts, ask relevant questions, and effectively collaborate with colleagues across different teams, especially during incident response\n\nAnalytical and flexible mindset: able to approach issues from different perspectives, build logical chains, make informed decisions, and independently suggest solutions\n\nProactivity and ownership: takes responsibility for decisions and results, double-checks own work, learns from mistakes and feedback, and actively develops professional skills\n\nNice to have:\nKnowledge of information security best practices (NIST, ISO) and ability to cite them when necessary\n\nBasic knowledge of Docker and Kubernetes, understanding their monitoring features\n\nExperience writing correlation rules in SIEM\n\nExperience with NTA (Network Traffic Analysis) tools\n\nExperience working with online reputation services (VT, AnyRun, IPAbuseDB, etc.)\n\nExperience developing instructions for alert verification and/or writing information security incident response scenarios\n\nExperience with Kafka, ELK, Graylog, etc\n\nStrong Linux system administration experience\n\nExpertise in network, host, and cloud-based analysis and investigation\n\nA strong understanding of attack pipelines (MITRE ATT&CK Framework, Cyber Kill-Chain)\n\nFamiliarity with CI/CD, software development lifecycle, and Infrastructure-as-Code (Terraform/Ansible/etc)\n\nProficiency in automation (Bash/PowerShell, Python)\n\nExperience with log collection, delivery, and normalization\n\nStrong knowledge of open-source solutions for endpoint & infrastructure security, such as Audit.d, Sysmon, AppArmor, SELinux, etc\n\nFundamental static and dynamic malware analysis skills\n\nOffensive experience (penetration testing, red teaming)\n\nOur Benefits:\nPrivate health insurance\n\nSports benefits\n\nComprehensive Mental Health Program\n\nFree English lessons (online)\n\nLocal language courses\n\nPaid time off\n\nMaternity leave support\n\nReferral program rewards\n\nUpskilling, internal workshops, and participation in professional conferences and corporate events","description_format":"text","description_chars":3601,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Health insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Gaming","Sports Betting","iGaming & Gambling"],"lifecycle":[{"event":"open","at":"2026-09-15T12:57:46Z"}],"visa":[],"liveness":{"score":34,"band":"fade","label":"Fading","p_open":1,"p_active":0.619,"p_room":0.55,"age_days":53,"expected_fill_days":38,"reasons":["conf:29","velocity","win:tail"],"computed_at":"2026-11-08T05:47:12Z"},"pay":null,"html_url":"https://alion.io/job/softswiss-incident-response-analyst","json_url":"https://alion.io/job/softswiss-incident-response-analyst.json","meta":{"generated_at":"2026-11-09T02:16:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4724,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8389},"rest":"https://alion.io/mcp/rest/get_company?id=8389"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsoftswiss-incident-response-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsoftswiss-incident-response-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsoftswiss-incident-response-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/softswiss-incident-response-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsoftswiss-incident-response-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":933313}},{"tool":"search_jobs","arguments":{"company":"softswiss.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":933313},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}