Monitoring & Incident Response Officer

Job title : Monitoring & Incident Response Officer

The Monitoring & Incident Response Officer is responsible for continuously monitoring the organization's security environment, detecting and responding to cybersecurity threats, and supporting incident management activities. The role involves triaging security alerts, investigating potential security incidents, analyzing logs and security events, and implementing containment measures to minimize risk. The officer will work with security tools such as SIEM, EDR, Microsoft Sentinel, CyberArk PAM, Active Directory, and Microsoft Entra ID to protect the organization's cloud and on-premises infrastructure. Working within a 24×7 Security Operations Centre (SOC), the role ensures timely escalation, documentation, and resolution of security incidents while contributing to threat detection, security monitoring, and continuous improvement of cybersecurity operations.

Job Details

• Monitor security alerts and events generated by SIEM, EDR, PAM, and other cybersecurity tools.
• Investigate and triage suspected security incidents, determining severity and impact.
• Perform incident response activities, including analysis, containment, eradication, and recovery.
• Escalate security incidents in accordance with established incident response processes and playbooks.
• Conduct phishing, malware, and suspicious activity investigations.
• Analyze logs from operating systems, applications, network devices, and cloud platforms to identify potential threats.
• Support CyberArk Privileged Access Management (PAM) monitoring and investigation of privileged-user activities.
• Monitor Microsoft Sentinel and other security platforms to identify indicators of compromise.
• Perform endpoint isolation and containment actions where required.
• Leverage threat intelligence feeds and the MITRE ATT&CK framework to improve threat detection and response.
• Support security monitoring across cloud and on-premises environments.
• Document incident findings, root causes, actions taken, and lessons learned.
• Maintain SOC dashboards, reports, metrics, and incident records.
• Participate in shift-based 24×7 security operations coverage.
• Assist in developing and improving security monitoring use cases, alerts, and incident response procedures.
• Collaborate with IT, Infrastructure, Risk, Compliance, and business teams during security investigations and remediation efforts.

Requirements

Education

• Bachelor's degree in information security, Computer Science, Information Technology, Cybersecurity, or a related field.

Experience

• 0–2 years of experience in Security Operations Centre (SOC), Information Security, Incident Response, IT Operations, or Cybersecurity within a financial institution or regulated environment.

Professional Certifications (Preferred)

• Blue Team Level 1 (BTL1)
• Hack The Box Certified Defensive Security Analyst (HTB CDSA)
• Microsoft Security Operations Analyst (SC-200)
• CompTIA CySA+
• CompTIA Security+