{"id":2413832,"url":"https://alion.io/job/stefanini-cyber-security-services-sr-incident-response-analyst","title":"Cyber Security Services Sr Incident Response Analyst","company":{"id":4425653,"name":"Stefanini EMEA","domain":"stefanini.ro","url":"https://alion.io/company/stefanini-ro","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartSearch","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Romania"],"countries":["RO"],"hiring_countries":["RO"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":29000,"max_usd":67000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2225},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Microsoft Entra ID","optional":false},{"name":"SDL","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"C","optional":true}],"status":"live","first_seen_at":"2026-10-01T12:00:00Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-24T20:32:27Z","board_verified":true,"closed_at":null,"days_open":23,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":23},"description":"Stefanini Group is seeking a skilled Cyber Security Services (CSS)Sr Incident Response (IR) Analyst to join our Security Operations Center.\nAs a CSS Sr.IR Analyst, you will manage security incidents, develop incident response processes, and enhance security configurations tailored to client needs. This is and L3-level position, wherw your expertise will be key to reducing false positives and identifying security gaps within the client's IT infrastructure.\nWork Schedule: Two rotating 8.5-hour shifts within the 8:00 a.m.-8:00 p.m. EET coverage window.\n\nJob responsibilities:\nOwn assigned security alerts, incidents, and escalated tickets by conducting triage, cross-source investigations, and response activities across endpoints, identities, email, networks, cloud environments, and other relevant data sources using available security telemetry and investigation platforms.\nAnalyze endpoint activity to identify indicators of compromise and adversary behaviors, including malicious execution, persistence, privilege escalation, and lateral movement.\nInvestigate suspicious user and identity activity by analyzingMicrosoft Entra ID authentication logs, sign-in activity, access patterns, anomalies, and other identity-related telemetry.\nUse SentinelOne Singularity Data Lake and SDL PowerQuery to perform advanced searches, correlate events, analyze threats, and support security investigations.\nDevelop and validate investigation hypotheses using structured incident response, threat hunting, and forensic analysis methodologies.\nExecute containment, eradication, and recovery activities while coordinating with relevant technology owners and stakeholders to validate findings, contain threats, and restore affected services in accordance with approved incident response procedures and playbooks.\nDocument investigative actions, evidence, analysis, decisions, communications, containment measures, and recovery activities throughout the incident lifecycle.\nPrepare detailed P1 and P2 incident reports covering the incident timeline, root cause, impact assessment, actions taken, current status, and lessons learned.\nProvide metrics and analysis on mean time to acknowledge, investigate, and resolve incidents by severity and lifecycle stage.\nProvide feedback on detection logic, alert quality, false positives, telemetry gaps, and monitoring improvement, recommending rule-tuning adjustments and new detection use cases based on emerging threats, vulnerabilities, observed activity, and attack patterns.\nProduce weekly operational reports on alert volumes and status, operational trends, investigation outcomes, false-positive rates by detection source.\nParticipate in security operations meetings and present incident findings, operational trends, detection performance, service-level results, and improvement recommendations.\nIdentify security gaps, recommend mitigation measures, and support SOAR automation workflows by providing operational feedback and identifying suitable automation opportunities to enhance operational efficiency.\nContribute to the development, maintenance, and refinement of standard operating procedures, incident response playbooks, investigation guides, workflows, and process documentation.\nSupport monthly security tool and log-source health checks by validating data availability, alert coverage, and investigation readiness.\nCollaborate with security analysts, incident responders, threat hunters, technology owners, and stakeholders across multiple teams and time zones to implement security best practices.\nProvide technical guidance, coaching, and mentoring to junior analysts, fostering a collaborative and learning-focused environment.\nEducation:\nPreferred: Bachelor's degree in computer science, Information Technology, Engineering, or a related field.\nMinimum education requirement: High school studies completed with Baccalaureate diploma.\nLanguage proficiency:\nExcellent English communication skills, both verbal and written, for professional communication and documentation.\nExperience:\nMinimum 3 years of experience in cybersecurity operations, including hands-on experience investigating and responding to security incidents across endpoints, network, cloud, and other technology environments.\nDemonstrated experience working in a Security Operations Center, Global Security Operations Center, Managed Security Service, or similar 24/7 operational environment.\nMandatory Technical Skills:\nStrong understanding of cybersecurity principles, incident response methodologies, structured threat hunting and basic digital forensics.\nStrong knowledge of industry frameworks and best practices, including NIST incident response guidance and structured threat hunting methodologies.\nHands-on experience with security analytics platforms and query languages to investigate security events, correlate data from multiple sources, and support threat hunting and incident response activities.\nProficiency with Microsoft Entra ID and security technologies such as SIEM, SEG, EDR, XDR, and NDR.\nFamiliarity with SOAR platforms and security automation concepts.\nAbility to develop and maintain standard operating procedures, incident response playbooks, workflows, and technical documentation.\nPreferred / Nice-to-Have Qualifications:\nHands-on proficiency with SentinelOne Singularity Data Lake (SDL), including PowerQuery for investigation, event correlation, and threat analysis.\nHands-on certifications in incident response, forensics, threat hunting, or malware analysis - for example GCIH, GCFA, GCDA, GREM, ECIH, CySA+, eCTHP, CDSA, or OSCP. Equivalent practical evidence (published research, open-source detection contributions) is weighted equally. \nProfessional Skills:\nAbility to perform effectively during crises, make sound decisions, recommend effective solutions, and manage competing priorities during security incidents.\nAbility to work effectively in a complex global environment involving multiple entities, varying levels of IT maturity, and diverse regulatory requirements.\nStrong communication and collaboration skills, enabling effective interaction with a diverse range of technical and non-technical stakeholders and internal teams.\nA customer-focused mindset dedicated to delivering exceptional service.\nA collaborative mindset with an interest in internal operations and process improvement.\nStrong organizational, attention to detail, analytical thinking and a proactive approach to problem-solving.\nAbility to quickly adapt to changes, new requirements, or sudden shifts in direction.\nA commitment to continuous learning and improvement, staying abreast of industry best practices, emerging technologies, and methodologies.\nAbsolute discretion and integrity in handling sensitive customer information and critical infrastructure data.\nAvailability for on-call responsibilities, if required. \nWhat's next:\nIt's best to apply today, because job postings can be taken down and we wouldn't want you to miss this opportunity. In case you need further information, just send us a message at  and we'll be happy to assist!\nThe preceding job description had been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties and responsibilities required of employees assigned to this job.\nDiversity & Inclusion\nHere at the Stefanini Group, we value plurality and equity, regardless of race, sexual orientation, disability, age, ancestry, religion, gender, and nationality. We understand and encourage the importance of being you!\nAbout us\nWe are the Stefanini group, a global tech consulting company of Brazilian origin that believes in the power of people to transform businesses through technology.\nWe are present in over 40 countries and operate with the purpose of co-creating solutions TOGETHER WITH OUR CLIENTS that accelerate results and improve the experience of people and organizations.\nHere, we like to say that technology is not the end, but the means: what really matters are the people who drive it all.\nOur mindset is AI First, meaning we invest in cutting-edge technology in everything we do, focusing on results for our clients.\nWe are a company, A GROUP, that breathes collaboration and offers a dynamic environment where you will learn by doing, grow alongside the team, and have space to contribute with ideas and projects.\nMore than just talking about digital transformation, we believe in real transformation that starts with people and impacts real businesses.\nIf you are looking for a place to develop, innovate, and be part of something bigger, the Stefanini Group is your place.\nWe want to inform you that there are currently scams targeting job seekers by falsely using our company's name, Stefanini. We sincerely apologize for any confusion or inconvenience this may have caused.\nPlease remember that legitimate job offers from Stefanini will always come through official channels, including direct communication with our trained recruiters. If you receive any unsolicited messages requesting payment or personal information, please disregard them.\nIf you suspect you've been targeted, please contact us immediately at  for verification.\nKey Points to Remember:\n* Legitimate job offers only follow interviews conducted with our hiring managers or clients.\n* We will never ask for payment at any stage of the recruitment process.\nStay vigilant and feel free to reach out for verification. Your safety and security are our top priorities. Thank you for your understanding and cooperation.\nEducation:\nPreferred: Bachelor's degree in computer science, Information Technology, Engineering, or a related field.\nMinimum education requirement: High school studies completed with Baccalaureate diploma.\nLanguage proficiency:\nExcellent English communication skills, both verbal and written, for professional communication and documentation.\nExperience:\nMinimum 3 years of experience in cybersecurity operations, including hands-on experience investigating and responding to security incidents across endpoints, network, cloud, and other technology environments.\nDemonstrated experience working in a Security Operations Center, Global Security Operations Center, Managed Security Service, or similar 24/7 operational environment.\nMandatory Technical Skills:\nStrong understanding of cybersecurity principles, incident response methodologies, structured threat hunting and basic digital forensics.\nStrong knowledge of industry frameworks and best practices, including NIST incident response guidance and structured threat hunting methodologies.\nHands-on experience with security analytics platforms and query languages to investigate security events, correlate data from multiple sources, and support threat hunting and incident response activities.\nProficiency with Microsoft Entra ID and security technologies such as SIEM, SEG, EDR, XDR, and NDR.\nFamiliarity with SOAR platforms and security automation concepts.\nAbility to develop and maintain standard operating procedures, incident response playbooks, workflows, and technical documentation.\nPreferred / Nice-to-Have Qualifications:\nHands-on proficiency with SentinelOne Singularity Data Lake (SDL), including PowerQuery for investigation, event correlation, and threat analysis.\nHands-on certifications in incident response, forensics, threat hunting, or malware analysis - for example GCIH, GCFA, GCDA, GREM, ECIH, CySA+, eCTHP, CDSA, or OSCP. Equivalent practical evidence (published research, open-source detection contributions) is weighted equally. \nProfessional Skills:\nAbility to perform effectively during crises, make sound decisions, recommend effective solutions, and manage competing priorities during security incidents.\nAbility to work effectively in a complex global environment involving multiple entities, varying levels of IT maturity, and diverse regulatory...","description_format":"text","description_chars":15652,"description_truncated":true,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"high_school","optional":true},"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":true}]},"benefits":["Continuous learning","Equity"],"hiring_locations":[{"name":"Romania","iso":"RO","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Incident Response"],"lifecycle":[{"event":"open","at":"2026-10-13T02:45:44Z"}],"visa":[],"liveness":{"score":58,"band":"ok","label":"Likely open","p_open":1,"p_active":0.767,"p_room":0.75,"age_days":22,"expected_fill_days":23,"reasons":["conf:1","velocity","win:late"],"computed_at":"2026-10-24T06:02:35Z"},"pay":null,"html_url":"https://alion.io/job/stefanini-cyber-security-services-sr-incident-response-analyst","json_url":"https://alion.io/job/stefanini-cyber-security-services-sr-incident-response-analyst.json","meta":{"generated_at":"2026-10-24T21:49:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":32027,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-25T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4425653},"rest":"https://alion.io/mcp/rest/get_company?id=4425653"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fstefanini-cyber-security-services-sr-incident-response-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fstefanini-cyber-security-services-sr-incident-response-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fstefanini-cyber-security-services-sr-incident-response-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/stefanini-cyber-security-services-sr-incident-response-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fstefanini-cyber-security-services-sr-incident-response-analyst"}]}