Cyber Security Incident Response Team (CSIRT) Officer

About this role

At MindWave, we’re not just building teams. We’re building a new way of working. We’re creating a community of experts who thrive in a transparent, human, and forward-thinking environment.

We are currently looking for a Cyber Security Incident Response Team (CSIRT) Officer to join our community and support a major CISO Cybersecurity Center of Excellence team. In this role, you will contribute to daily security incident preparation, detection, and response activities—including threat detection, level 3/4 incident handling, forensic analysis, threat hunting, and SIEM engineering—while working closely with internal staff, affiliates, and external security service providers.

Key Responsibilities

• Incident Handling & Level 3/4 Response
• Investigate and respond adequately to Level 3/4 security incidents, including malware infections, network intrusions, and data breaches across IT, IoT, and OT environments.
• Conduct forensic investigations, technical coordination, and deep-dive analysis of security incidents regardless of origin.
• Work closely with SOC, CSIRT, and cross-functional internal teams to identify, mitigate, and remediate security risks.
• Develop, refine, and implement incident response plans and procedures, providing guidance on security best practices across the organization.
• Clearly communicate and report security incident progress, risks, and post-incident analysis to internal and external stakeholders.
• Threat Detection & Threat Hunting
• Proactively identify threats and vulnerabilities across the organization's infrastructure using SIEM platforms and custom detection tools.
• Conduct regular threat hunting exercises to detect potential threats that have evaded traditional security controls.
• Collect and analyze security data and system artifacts (analyzing Windows, Linux, network, and security logs) to identify anomalous behavior and indicators of compromise (IOCs).
• Collaborate closely with the 3rd party SOC team to investigate potential security incidents and provide technical guidance on threat remediation and mitigation strategies.
• SIEM Engineering & Automation
• Develop, maintain, and optimize SIEM systems (e.g., Microsoft Sentinel) to ensure timely detection and rapid incident response.
• Create, refine, and maintain custom detection rules and use cases aligned with the MITRE ATT&CK framework.
• Author and maintain detailed playbooks for the SOC team to ensure standardized, consistent, and effective incident response.
• Automate alert handling and response workflows for SIEM and EDR events to streamline security operations and allow the SOC/CSIRT to focus on high-priority threats.
• Projects, Exercises & Continuous Improvement
• Organize, animate, and facilitate cybersecurity tabletop exercises to test organizational incident response readiness.
• Contribute to security engineering projects based on team needs, such as deploying, maintaining, and integrating new security platforms or tools.
• Script and automate manual operational tasks to enhance the team's efficiency and detection capabilities.
• Team Context

You will join the CISO Cybersecurity Center of Excellence team within the enterprise CISO organization. You will collaborate closely with fellow CSIRT officers, internal IT/OT/IoT teams, the 3rd party Security Operations Center (SOC) team, organizational affiliates, and external security service providers.

Requirements

• Conformity & Qualification Criteria
• Education: Bachelor's degree in Computer Science, Information Security, a related field, or equivalent professional experience.
• Experience: Minimum 4 years of professional experience in a security-related role, with a strong focus on incident response and technical security analysis.
• Tabletop Exercises: Demonstrated experience in organizing, planning, and animating tabletop exercises.
• Certifications: Relevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, GREM, or equivalent.
• Language Proficiency: Spoken and written fluency in English (minimum C1 level). Working knowledge of Dutch (NL) or French (FR) is an asset.
• Location & Presence: Hybrid setup with presence at the client office in Brussels
• Key Technical Competencies & Evaluation Assets
• Strong analytical and problem-solving skills with the ability to identify and respond to security incidents in a timely, calm, and effective manner.
• Hands-on experience with Incident Response tools and platforms (e.g., ServiceNow SIR module), forensics frameworks, and malware analysis.
• Strong technical expertise in security technologies and ecosystem tools, such as Microsoft Sentinel SIEM, EDR solutions, Microsoft Defender suite, intrusion detection/prevention systems (IDS/IPS), and firewalls.
• Practical experience in SOC/SIEM engineering, identifying gaps in detection coverage, writing MITRE ATT&CK-mapped use cases, and building automated playbooks.
• Proven knowledge in security monitoring, digital forensics, threat intelligence, and log analysis (Windows, Linux, network devices).
• Customer-focused mindset with the ability to handle security incidents in an organization-sensitive and diplomatic manner.
• Working knowledge of French (FR) or Dutch (NL).
• 🌱 Soft Skills and MindWave Mindset
• At MindWave, we value people who are not only strong in what they do, but also in how they work with others.
• Autonomy & Ownership: You take full ownership of security incidents and feel comfortable working with high autonomy. You stay calm under pressure, explore technical anomalies methodically, and turn analysis into concrete action plans.
• Pragmatism & Open Communication: You combine technical thoroughness with a pragmatic approach to risk. You communicate openly when you identify security gaps, risks, or opportunities for automation.
• Curiosity & Knowledge Sharing: Cybersecurity moves fast. You are naturally curious, eager to experiment with new threat hunting techniques or detection frameworks, and passionate about sharing knowledge with your peers.
• Transparency & Trust: You value transparency, trust, and clear communication—especially during critical security incidents when clarity and human connection matter most.

Benefits

Why Join MindWave?

• 🧠 Community of Experts: Natural and planned knowledge-sharing moments, such as brown bag sessions on AI, cybersecurity innovations, and emerging tech.
• 🏝️ Flexible Setup: Balanced hybrid setup aligning client operational requirements with remote flexibility and strong community support.
• 🚀 Transparent & Human Culture: A transparent working environment where you can grow, contribute, and be yourself.
• 🌱 Accessible Leadership: Direct interaction and genuine involvement from leadership in the lives of our consultants and community.
• 🌍 High-Impact Project: A long-term, technically challenging mission protecting critical enterprise infrastructure.
• ⚖️ Competitive Package: Complete package for employees (medical insurance, meal vouchers, training budget, remote-work allowance) and full transparency on rates and fees for freelancers.