Senior Cybersecurity Incident Handler
Summary
On-site senior incident handler in Lisbon who acts as the technical liaison between a remote SOC and the client's internal teams, coordinating the full incident response lifecycle and investigating alerts, logs and network traffic. Core stack: IBM QRadar SIEM, Microsoft Azure/Defender/365, and Cisco, Fortinet and Check Point network security.
Role Overview
We are looking for an experienced Cybersecurity Incident Handler to join a challenging security operations environment in Lisbon.
You will act as the on-site technical point of contact between a remote Security Operations Centre (SOC) and the client's internal teams, coordinating security incident investigations and ensuring timely, effective response actions.
This is an excellent opportunity for a hands-on cybersecurity professional who combines strong technical investigation skills with the ability to manage critical incidents and communicate confidently with business and technical stakeholders.
Key Responsibilities
- Coordinate the full cybersecurity incident response lifecycle, from initial assessment and investigation to containment, eradication and recovery.
- Analyse security events, correlate logs and reconstruct incident timelines to identify attack paths, lateral movement and potential data exfiltration.
- Provide technical recommendations and coordinate incident containment, remediation and recovery activities with internal IT teams.
- Investigate suspicious network traffic, security alerts and abnormal behaviour across enterprise environments.
- Act as the primary on-site technical liaison between the remote SOC and client stakeholders, ensuring clear communication and effective incident management.
Requirements
- Degree or relevant vocational qualification in Computer Science, Information Technology, Electrical Engineering or a related field.
- Strong Portuguese communication skills and technical English proficiency are preferred; final language requirements will be confirmed.
- At least 5 years of experience in SOC operations and cybersecurity incident response, with proven knowledge of IBM QRadar SIEM.
- Hands-on knowledge of Microsoft Azure, Microsoft Defender and Microsoft 365, combined with practical network security experience involving Cisco, Fortinet and Check Point technologies.
- Strong incident investigation, analytical and stakeholder communication skills, with the ability to work on-site in Lisbon and attend P1 incidents within 2 hours outside normal working hours.