- Company Name
- U.Neat
- Job Title
- Consultant CSIRT (senior)
- Job Description
-
**Job Title:** Senior CSIRT Consultant
**Role Summary:**
Provide expert consultation on cyber‑security incident response, conducting forensic investigations, orchestrating remediation, and enhancing CSIRT processes across SOC, CTI, and partner organizations.
**Expectations:**
- Lead advanced incident investigations and post‑incident analysis.
- Drive playbook automation, coordination of major incidents, and crisis communication.
- Continuously improve detection rules, knowledge‑base documentation, and CERT maturity.
**Key Responsibilities:**
- Execute forensic analysis of endpoints, servers, and network logs to identify attack vectors, scope, and attacker actions.
- Contribute to remediation: containment, eradication, restoration, and post‑incident verification.
- Author technical investigation reports and Incident Report Summaries (IRR).
- Design, automate, and maintain response playbooks using platforms such as TheHive, Cortex, and SOAR.
- Participate in major incident handling and cyber‑security crisis cells.
- Communicate technical findings to SOC, CTI, PSIRT, engineering teams, CERT‑FR, ANSSI, and external partners.
- Advise management on decision‑making during crises.
- Update and enrich incident knowledge base; conduct post‑incident reviews (REX).
- Identify SOC detection gaps and propose correlation rules.
- Help advance CERT capabilities through tool integration, automation, and maturity development.
- Leverage CTI information to anticipate threats and return indicators (IOCs) from investigations.
**Required Skills:**
- SIEM/EDR: Splunk, SentinelOne, CrowdStrike, ELK.
- Orchestration/Ticketing: TheHive, Cortex, MISP, OpenCTI, ServiceNow.
- Forensics & Analysis: Velociraptor, Autopsy, Volatility, Wireshark.
- Detection & Correlation: Sigma, Yara, Suricata.
- Systems: Windows, Linux, Active Directory, AWS, Azure.
- Strong analytical, communication, and crisis‑management abilities.
**Required Education & Certifications:**
- Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or related field (or equivalent professional experience).
- Industry certifications preferred:
- CISA / CISSP / CISM / GCIH
- GIAC Certified Incident Handler (GCIH) or GIAC Certified Forensics Analyst (GCFA)
- OSCP or equivalent penetration testing credentials (optional).