Incident Analyst

Role - Incident Response

Location- Doha Qatar

• Perform deep-dive forensic analysis and investigation of security incidents, leveraging various tools such as SIEM, EDR, and other threat intelligence sources
• Develop and implement incident response playbooks, processes, and procedures, continuously improving incident handling and response times.
• Conduct post-incident reviews, ensuring the documentation of root causes, lessons learned, and recommended corrective actions.
• Proactively hunt for advanced threats in the organization’s environment using threat intelligence feeds, SIEM, EDR, and other security tools.
• Analyse network traffic, system logs, endpoint data, and threat intelligence to identify anomalies and potential indicators of compromise (IOCs).
• Leverage frameworks like MITRE ATT&CK to develop and refine detection and hunting techniques.
• Conduct threat modelling and scenario-based hunting exercises to identify hidden or dormant threats.
• Collaborate with SOC and other security teams to improve detection capabilities and response processes based on findings from hunting operations.
• SIEM management experience is a plus

Required skills

• Proven track record in leading incident response efforts, including root cause analysis, containment, and mitigation of complex security incidents.
• Experience with threat-hunting methodologies, frameworks, and tools (e.g., MITRE ATT&CK, OSINT, YARA rules, etc.).
• Familiarity with SIEM platforms (e.g., LogRhythm, Splunk, ArcSight, or similar), EDR solutions (e.g., CrowdStrike, Carbon Black, etc.), and threat intelligence tools.
• Strong experience with forensic analysis and investigation techniques for identifying malware, ransomware, and other advanced threats.
• In-depth knowledge of networking, operating systems (Windows, Linux), and cybersecurity tools.
• Solid understanding of advanced persistent threats (APTs), attack vectors, and TTPs (Tactics, Techniques, and Procedures).
• Team Player
• Exposure in M365 Defender
• Experience in endpoint security solutions is a plus
• Experience in SOAR is a plus