Senior Cybersecurity Incident Handler

Role Overview

We are looking for an experienced Cybersecurity Incident Handler to join a challenging security operations environment in Lisbon.

You will act as the on-site technical point of contact between a remote Security Operations Centre (SOC) and the client's internal teams, coordinating security incident investigations and ensuring timely, effective response actions.

This is an excellent opportunity for a hands-on cybersecurity professional who combines strong technical investigation skills with the ability to manage critical incidents and communicate confidently with business and technical stakeholders.

Key Responsibilities

• Coordinate the full cybersecurity incident response lifecycle, from initial assessment and investigation to containment, eradication and recovery.
• Analyse security events, correlate logs and reconstruct incident timelines to identify attack paths, lateral movement and potential data exfiltration.
• Provide technical recommendations and coordinate incident containment, remediation and recovery activities with internal IT teams.
• Investigate suspicious network traffic, security alerts and abnormal behaviour across enterprise environments.
• Act as the primary on-site technical liaison between the remote SOC and client stakeholders, ensuring clear communication and effective incident management.

Requirements

• Degree or relevant vocational qualification in Computer Science, Information Technology, Electrical Engineering or a related field.
• Strong Portuguese communication skills and technical English proficiency are preferred; final language requirements will be confirmed.
• At least 5 years of experience in SOC operations and cybersecurity incident response, with proven knowledge of IBM QRadar SIEM.
• Hands-on knowledge of Microsoft Azure, Microsoft Defender and Microsoft 365, combined with practical network security experience involving Cisco, Fortinet and Check Point technologies.
• Strong incident investigation, analytical and stakeholder communication skills, with the ability to work on-site in Lisbon and attend P1 incidents within 2 hours outside normal working hours.