Incident Response Analyst

Talentgrator is a recruitment and talent partner focused on the IT entertainment and iGaming sectors, connecting businesses with specialized professionals. We work with teams that need strong technical expertise and dependable execution in fast-moving environments where security, resilience, and operational discipline matter every day.

We are looking for an Incident Response Analyst to join our Security team and operate on the front line of protecting the company’s infrastructure and services. This role is for someone who goes beyond simply reviewing alerts — you investigate incidents deeply, build detection logic, and help reduce response time proactively while strengthening the team’s ability to respond to threats with speed and clarity.

Responsibilities

• Work with WAF to analyze anomalous traffic, respond to web attacks, and fine-tune rules.
• Work with DLP and MDM to investigate data leaks, analyze policy violations, and collaborate with teams on findings.
• Monitor and triage alerts in SIEM, analyzing events, classifying incidents, and prioritizing response.
• Integrate new log sources into SIEM, including normalization, parsing, and enrichment.
• Develop and improve detection rules, correlation rules, and dashboards.
• Reduce MTTR by identifying bottlenecks in response processes and implementing automation and runbooks.
• Participate in incident post-mortems and provide actionable recommendations.
• Conduct security incident investigations by collecting artifacts, reconstructing timelines, and performing root cause analysis.

Requirements

What We Expect

• 3+ years of experience in Incident Response or Security Operations
• Hands-on experience with SIEM platforms (Splunk, ELK/OpenSearch, Graylog, or similar)
• Ability to read and interpret logs: OS (Linux/Windows/macOS), network, applications, cloud
• Understanding of network protocols and traffic analysis (Wireshark, Zeek, etc.)
• Knowledge of attacker tactics and techniques (MITRE ATT&CK, kill chain, IOC/TTP)
• Ability to independently lead investigations from alert to final report
• Scripting skills for automation (Python / Bash)
• Basic understanding of integrating LLM-based tools
• Native-level Russian proficiency

Nice to Have

• Experience with SOAR platforms and building playbooks
• Experience with EDR/XDR solutions (CrowdStrike, SentinelOne, etc.)
• Participation in CTFs, red team / blue team exercises, or pentesting
• Experience with cloud logs (AWS CloudTrail, GCP Audit Logs, etc.)
• Experience integrating security tools via APIs and automating response using LLM

Benefits

• 25 vacation days and 5 family days yearly
• Flexible start to the workday
• Support from a professional corporate coach and psychologist
• Regular internal and external activities, workshops, trips, and corporate events
• Access to our internal knowledge base, meetups, and team-building activities
• Ongoing training in new technologies and continuous professional development support