Incident Response Analyst - L2

About the role

As an Incident Response Analyst (L2) at SOFTSWISS, you will be an integral part of the Security Operations team, focusing on complex security incidents and improving overall incident response strategies. Your work will involve digital forensics, malware analysis, and collaboration with various teams to address security challenges effectively.

Success in this role requires a strong grasp of modern cyber threats and hands-on experience with SIEM platforms. You will also mentor L1 analysts and contribute to developing detection rules and incident response playbooks, ensuring the organization is well-prepared to handle security incidents.

Skills that matter here

• Incident Response: This role involves investigating and responding to security incidents throughout their lifecycle.
• Digital Forensics: You will perform digital forensic investigations to determine the scope and root cause of incidents.
• Malware Analysis: Hands-on experience in malware analysis is essential for understanding and mitigating threats.
• SIEM: You will work with SIEM platforms to develop detections and analyze security events.
• Python: Scripting in Python will be used to automate repetitive tasks within the SOC.
• PowerShell: PowerShell will be utilized for automation and incident response activities.

Who this role suits

• Has a background in SOC, Incident Response, or DFIR with at least 3 years of experience.
• Possesses strong analytical and problem-solving skills.
• Is comfortable working in cross-functional teams and communicating effectively.
• Demonstrates a proactive approach to threat hunting and incident management.

From the employer

Key responsibilities:

• Investigate and respond to complex security incidents throughout the entire incident lifecycle
• Perform digital forensic investigations, malware analysis, and evidence collection to determine the scope and root cause of security incidents
• Analyze attack techniques, correlate security events, and reconstruct attack timelines
• Develop and improve SIEM detections, correlation rules, and incident response playbooks
• Conduct threat hunting activities and reduce false positives through detection tuning
• Automate repetitive SOC activities using scripting where appropriate
• Collaborate with Infrastructure, Development, IT, and Security teams during incident response
• Mentor L1 analysts by providing technical guidance and feedback

Required Experience:

• 3+ years of experience in SOC, Incident Response, DFIR, or MSSP environments
• Strong understanding of modern cyber threats, attack techniques, and frameworks such as MITRE ATT&CK and the Cyber Kill Chain
• Hands-on experience investigating security incidents, performing digital forensics, and malware analysis
• Hands-on experience with SIEM platforms (e.g. Splunk, Wazuh, ClickHouse, Redash), including writing complex search queries, correlating events, and investigating large volumes of security data
• Good understanding of enterprise infrastructure, including Windows, Linux, macOS, Active Directory, email systems, Kubernetes, Docker, and databases
• Experience with automation using Python, PowerShell, or Bash
• Knowledge of Kubernetes and Docker security concepts
• Strong analytical mindset, problem-solving skills, and effective communication in cross-functional environments
• Intermediate or higher English level

Our Benefits:

• Private health insurance
• Sports benefits
• Comprehensive Mental Health Program
• Free English lessons (online)
• Local language courses
• Paid time off
• Maternity leave support
• Referral program rewards
• Upskilling, internal workshops, and participation in professional conferences and corporate events