Incident Handler

The Incident Handler is responsible for monitoring, investigating, and responding to security incidents to protect organizational systems, data, and infrastructure. The role plays a critical part in identifying threats, containing incidents, and driving remediation efforts while ensuring adherence to defined service levels and incident response procedures.

Working within a Security Operations Center (SOC) environment, the Incident Handler collaborates with cross-functional teams to investigate security events, perform root cause analysis, and strengthen incident response capabilities. The role also contributes to the continuous improvement of incident management processes, playbooks, and security posture.

Responsibilities:

Incident Detection & Response

• Monitor and respond to security incidents within defined SLAs
• Perform detailed analysis of security events and incidents to determine scope, impact, and severity
• Investigate alerts and escalate incidents as required to ensure timely resolution
• Coordinate response efforts across internal teams and stakeholders

Threat Analysis & Investigation

• Conduct threat analysis to identify indicators of compromise (IoCs), attack vectors, and system vulnerabilities
• Investigate suspected security breaches, attacks, and anomalous activities
• Perform root cause analysis to identify entry points and affected systems
• Escalate incidents requiring advanced investigation to digital forensics teams where applicable

Incident Containment & Remediation

• Identify and implement containment and eradication measures to mitigate security incidents
• Support recovery actions to restore affected systems and services
• Ensure proper closure of incidents and documentation of actions taken
• Participate in post-incident reviews to identify lessons learned and improvement areas

Process & Capability Development

• Support the development and enhancement of incident response processes, procedures, and playbooks
• Contribute to improving SOC incident handling capabilities and operational efficiency
• Assist in developing investigation frameworks and incident management best practices

Documentation & Reporting

• Maintain accurate records of incidents, investigations, and remediation activities using ticketing systems
• Prepare detailed incident reports, documentation, and analysis summaries
• Track incident trends and provide insights to improve security posture

Stakeholder Coordination

• Collaborate with internal teams including SOC, infrastructure, and security engineering teams
• Coordinate with multiple stakeholders to ensure effective execution of incident response plans
• Communicate incident status, risks, and actions clearly to relevant stakeholders

Requirements:
• 2–4 years of experience in SOC operations, incident response, or cybersecurity monitoring roles
• Hands-on experience in incident handling, threat analysis, and security investigations
• Bachelor’s degree in Computer Science, Information Security, or a related field
• Relevant certifications are preferred, such as: CISSP, CISM, SANS / GIAC
• Ability to work in a 24/7 SOC environment, including shift rotations if required
• Strong interest in cybersecurity trends, threat intelligence, and evolving attack techniques
• Commitment to continuous learning and professional development in cybersecurity