[Hiring] Incident Response Analyst @LITIT

Role Description

As a Cyber Security Incident Response Analyst, you will be responsible for detecting, investigating, and responding to cyber security incidents across enterprise environments. You will work across the full incident lifecycle — from initial alert and triage through investigation, containment, recovery, and post-incident review. The role has a strong focus on the Microsoft security ecosystem, including:

• Microsoft Sentinel
• Defender XDR
• Defender for Endpoint
• Microsoft Entra ID
• Microsoft 365
• Azure

You will also work closely with Cloud, Infrastructure, IAM, Risk, Compliance, and other technical teams to coordinate incident response activities and continuously improve security detection and response capabilities.

Responsibilities

• Monitor and investigate security alerts using Microsoft Sentinel and Microsoft Defender technologies.
• Triage incidents and determine severity, scope, impact, and required response actions.
• Investigate phishing, malware, compromised accounts, suspicious authentication, data loss, and unauthorized access.
• Perform endpoint, identity, Microsoft 365, Azure, email, and network investigations.
• Collect and analyze security logs, endpoint artifacts, authentication data, and network telemetry.
• Identify indicators of compromise (IOCs) and attacker techniques.
• Map attacker activity to MITRE ATT&CK where relevant.
• Coordinate containment, eradication, and recovery activities with technical teams.
• Perform threat hunting based on observed attacker behavior and threat intelligence.
• Develop and tune Microsoft Sentinel queries, analytics rules, and detection use cases.
• Improve existing detections and reduce false positives.
• Identify logging, telemetry, and security control gaps discovered during incidents.
• Maintain incident timelines, evidence, investigation records, and response actions.
• Support root cause analysis and post-incident reviews.
• Produce clear technical reports and management-level incident updates.
• Contribute to incident response playbooks, procedures, and cyber security exercises.

Requirements

• Practical experience in SOC, Cyber Security Incident Response, or a similar security operations role.
• Strong hands-on experience with Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Endpoint.
• Experience investigating Microsoft Entra ID identity and authentication activity.
• Experience investigating security incidents across Microsoft 365 and Azure environments.
• Understanding of Microsoft Defender for Identity and Microsoft Defender for Cloud.
• Strong KQL skills for security investigations, threat hunting, and detection development.
• Experience analyzing Windows endpoint and security logs, with working knowledge of Linux security and log analysis.
• Good understanding of network security, traffic analysis, and packet captures.
• Understanding of IAM, endpoint security, email security, vulnerability management, and DLP.
• Strong understanding of the complete incident response lifecycle, including containment, eradication, recovery, and post-incident review.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain, and NIST incident response practices.
• Understanding of forensic evidence handling and chain of custody principles.
• Strong analytical and troubleshooting skills with the ability to independently investigate complex security incidents.
• Ability to prioritize and make decisions during active incidents.
• Strong communication skills and the ability to explain technical findings clearly to both technical and non-technical stakeholders.
• Willingness and readiness to travel as required by project or client needs, including occasional domestic or international travel, sometimes on short notice.

Benefits

• Salary range: €3500 - €5200 (GROSS) / month.
• Learning opportunities with compensated certificates, learning lunches, and language lessons.
• Chance to switch projects after one year.
• Team building twice a year.
• Office in Vilnius, Lithuania that offers themed lunches and a pet-friendly environment.
• Remote work opportunities.
• Flexible time off depending on a project.
• Seasonal activities with colleagues.
• Additional health insurance and loyalty days for Lithuanian residents.
• Referral bonuses.
• Recognition of important occasions of your life.