About the mission
We are looking for an experienced Technical Team Lead for our CSIRT team. You will lead a team of security engineers, coordinate incident response, and develop technical strategies. The role requires at least 7 years of experience in security operations and compliance.
Read the full description
Job Description
We are looking for an experienced Technical Team Lead for our CSIRT team.
You will lead a growing team of security engineers, coordinate incident response, and develop technical detection and mitigation strategies. You will be responsible for triage, forensic investigation, root-cause analysis, and improving playbooks and automation. You will also be co-responsible for the security of our systems by designing and implementing adequate monitoring controls.
We are looking for an experienced Technical Team Lead for our CSIRT team.
You will lead a growing team of security engineers, coordinate incident response, and develop technical detection and mitigation strategies. You will be responsible for triage, forensic investigation, root-cause analysis, and improving playbooks and automation. You will also be co-responsible for the security of our systems by designing and implementing adequate monitoring controls.
Key Responsibilities
Design, implement, and maintain a CSIRT infrastructure, including SIEM, SOAR, CTI environment, etc.
Automate and script tasks using Python.
Set up and utilize open-source tooling.
Lead the CSIRT team in planning, prioritization, and ensuring adequate knowledge within the team.
Report on the performance of the CSIRT team, including providing sufficient KPIs.
Analyze logs and support incident investigations, including reporting.
Draft and maintain technical documentation.
Collaborate with team members and stakeholders; support during escalations and change activities.
Track and analyze vulnerabilities.
Follow up & analyze CTI.
Required Skills and Experience
At least 7 years of experience in a similar role, with in-depth knowledge of encryption, security operations, compliance, vulnerability management, mobile applications, bug bounty programs, blue team expertise, incident response, and forensic capabilities.
Proven knowledge and experience in very strict environments regarding security and compliance.
In-depth knowledge of implementing and managing security operations tools and SIEM systems, particularly Splunk Enterprise Security.
Experience securing mobile applications on iOS and Android platforms.
Experience tracking the latest vulnerabilities and assessing their impact.
Proven experience with incident response procedures, forensic techniques, and malware analysis.
Knowledge of relevant regulations and standards in information security.
Good knowledge of Enterprise Linux and one or more scripting languages (Python, Powershell, ...).
Excellent problem-solving skills and strong analytical ability.
Good communication skills and the ability to communicate effectively with stakeholders at all levels.
A passion for continuous learning and improvement, and the willingness to stay updated on the latest developments in the field.
Willing to work full-time on-site in Brussels (easily accessible by public transport and free underground parking).
Languages
Dutch and/or French and English (fluent in spoken and written).
Considered a Plus
Certifications such as OSCP, GCIH, GCIA, GNFA, CISSP, CISM.
Knowledge of security frameworks and best practices (MITRE ATT&CK, NIST, ...).
Experience with change management and ITIL processes.
Personal Attributes
Problem-solving and analytical ability.
Practical and hands-on oriented.
Strong communicator and team-oriented.
Accurate in documentation and configuration management.
What you'll do
- Design, implement, and maintain a CSIRT infrastructure, including SIEM, SOAR, CTI environment, etc.
- Automate and script tasks using Python
- Set up and utilize open-source tooling
- Lead the CSIRT team in planning, prioritization, and ensuring adequate knowledge within the team
- Report on the performance of the CSIRT team, including providing sufficient KPIs
- Analyze logs and support incident investigations, including reporting
- Draft and maintain technical documentation
- Collaborate with team members and stakeholders; support during escalations and change activities
- Track and analyze vulnerabilities
- Follow up & analyze CTI
What we're looking for
- At least 7 years of experience in a similar role
- In-depth knowledge of encryption, security operations, compliance, vulnerability management, mobile applications, bug bounty programs, blue team expertise, incident response, and forensic capabilities
- Proven knowledge and experience in strict security and compliance environments
- In-depth knowledge of implementing and managing security operations tools and SIEM systems, particularly Splunk Enterprise Security
- Experience securing mobile applications on iOS and Android platforms
- Experience tracking the latest vulnerabilities and assessing their impact
- Proven experience with incident response procedures, forensic techniques, and malware analysis
- Knowledge of relevant regulations and standards in information security
- Good knowledge of Enterprise Linux and one or more scripting languages (Python, Powershell, ...)
- Excellent problem-solving skills and strong analytical ability
- Good communication skills and ability to communicate effectively with stakeholders at all levels
- Passion for continuous learning and improvement
- Willing to work full-time on-site in Brussels
Skills
- SIEM
- SOAR
- Python
- Open Source Tools