CSIRT Incident Responder

Grant Thornton's Cyber Fusion Centre (CFC) is looking for an experienced CSIRT Incident Responder / Threat Hunter to protect enterprise systems and information by promptly responding to security threats and incidents. The role involves working both independently and as part of a team within cybersecurity operations including incident response, threat hunting, data analysis, and incident orchestration. The position operates in cooperation with SOC, platform engineering, IT infrastructure, IAM, network security, email security, legal/privacy, communications, and business stakeholders.

• 6+ years of experience in cybersecurity, SOC, or threat hunting.
• 2+ years of experience in major incident management.
• Experience working in a 24x7 SOC, CSIRT, MDR, MSSP, or enterprise security operations environment.
• Experience handling endpoint security incidents including malware infections, suspicious process execution, credential theft, lateral movement, persistence, and unauthorized access.
• Experience preparing incident timelines, technical findings, RCA inputs, management summaries, and post-incident reports.
• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or a related discipline preferred; equivalent practical experience will also be considered.
• Preferred certifications: GIAC Certified Incident Handler (GCIH), CrowdStrike Certified Falcon Responder (CCFR), CrowdStrike Certified Falcon Hunter (CCFH).
• Ownership mindset with strong attention to detail.
• Solid understanding of MITRE ATT&CK and the incident response lifecycle.
• Excellent written and verbal communication skills.
• Ability to brief both technical and non-technical stakeholders.
• Strong organization, time management, and attention to detail.
• Calm, structured decision-making under high-pressure incidents.
• Ability to work independently and as part of a team.
• Fluency in Polish and English.

Incident Response, Threat Hunting & Escalation:

• Protect enterprise systems and information by promptly responding to security threats and incidents individually and as part of a team.
• Receive major incident escalations from SOC detection operations and support response and reporting.
• Proactively hunt for threats and support containment, eradication, and recovery efforts.
• Analyze security incidents to identify root cause, determine impact, and improve incident handling procedures.
• Act as a subject matter expert, providing insight and guidance to technical teams on prevention, detection, and response.
• Research current methods, tools, and trends in incident response, threat hunting, and digital forensics.

CSIRT Incident Intake & Validation:

• Monitor designated CSIRT trigger channels for qualified potential incidents escalated by the SOC.
• Validate severity, business impact, affected assets, impacted users, attack scope, and urgency.
• Ensure incidents are responded to, recorded, tracked, and updated in line with the IR Runbook.

Major Incident Handling:

• Determine whether major incident criteria are met and launch the Major Incident Management (MIM) bridge or call per the Communication Plan.
• Initiate communications, maintain the incident timeline and summary, and brief stakeholders on MIM calls.
• Establish and maintain the agreed update cadence throughout the incident.
• Act as the incident response orchestrator during active security incidents.
• Proactively coordinate with relevant departments — management, legal, security, operations, infrastructure, privacy, communications, and business stakeholders.
• Mobilize incident responders across SOC, platform engineering, endpoint security, IAM, network security, email security, infrastructure, vulnerability management, and IT teams.
• Assign containment, investigation, eradication, recovery, and evidence preservation actions to the correct teams.
• Track execution of the incident response playbook.
• Oversee short-term containment actions per approved IR playbooks, and initiate approval for long-term containment where required.
• Coordinate with InfoSec and business leads on business context, asset criticality, containment approval, and BCP/DR triggers.
• Guide evidence preservation for forensic purposes in line with the IR Runbook and defined storage locations.
• Produce thorough incident reports and documentation, presenting findings to the team and leadership on a routine basis.
• Identify and manage lessons learned and corrective action plans.

Other Activities:

• Identify and help mitigate vulnerabilities and potential attack paths across the organization.
• Recommend SIEM detection enhancements, alert tuning, and response playbook improvements to engineering teams.
• Support deep-dive log analysis where root cause, attack path, or impact is unclear.
• Support the SOC team as needed.
• Conduct threat hunting activities across cross-platform security tooling.

Shift & Operational Requirements:

• Operate within 24x7 security operations and incident response environment.
• Participate in major incident bridges, MIM calls, and technical response calls.
• Communicate clearly with technical teams, business teams, management stakeholders, legal/privacy and communications teams.
• Follow structured incident response, evidence handling, reporting, and documentation practices.