Advanced Security Investigation and Incident Response Engineer

Location: Geneva · Contract: Permanent · Assignment: long term · Rate: 100% · Start: January 2027

For one of our clients based in Geneva, we are looking for an Advanced Security Investigation and Incident Response Engineer to strengthen their operational cybersecurity capabilities.

Context

The IT security monitoring and coordination team wishes to have a dedicated skill set for monitoring security events, investigating alerts, and qualifying cybersecurity incidents.

This role is part of the evolution of the operational security setup. It aims notably to enhance the exploitation of alerts produced by security solutions, particularly the EDR, as well as the organisation's ability to search for and analyse traces of a compromise and respond to eradicate it.

You will work in close interaction with the external SOC, operational security teams, and infrastructure, network, systems, applications, and IAM teams.

Your missions

• Detect, analyse, investigate and contribute to the handling of cybersecurity events and incidents, exploiting EDR alerts and other available security data sources

• Analyse detection coverage, propose, develop and adjust detection rules or use cases based on observed incidents, attack techniques and the MITRE ATT&CK framework

• Evaluate the quality of telemetry and security data necessary for investigation and identify visibility gaps

• Lead incident response: qualification, scope definition, containment, collection of technical elements, support for eradication and recovery, then capitalisation of lessons learned

• Coordinate technical aspects and investigations with the external SOC and infrastructure, network, systems, applications and IAM teams

• Transform a technical alert into an understanding of the security situation: what happened, on which system, with which account or identity, by which vector, what actions were taken, which other systems might be affected, whether it is a security incident or not, and what containment or remediation measures are necessary

• Propose, create and adjust detection rules and reduce false positive and false negative rates

Education

• University Master’s degree in computer science, EPF engineering diploma or equivalent

Essential skills

• Proven professional experience in SOC, CSIRT or incident response team, with effective practice of complex security investigations

• Excellent knowledge of SOC operating principles

• In-depth operational use of an EDR/XDR for investigation (process tree analysis, endpoint investigation, etc.), searching, trace collection and response actions

• Practical experience with a SIEM and mastery of a query language enabling investigations on large volumes of logs (SPL or equivalent)

• Mastery of log analysis

• Good knowledge of attacker techniques and tactics and ability to analyse them through MITRE ATT&CK

• Mastery of searching by IoC, IoA and TTP

• Ability to conduct a security investigation

• Knowledge of main attack techniques, persistence mechanisms and lateral movement

• Excellent understanding of Windows and Linux systems

• Knowledge of TCP/IP, DNS, HTTP(S), proxy, firewall and VPN

• Knowledge of Active Directory

• Understanding of authentication mechanisms (Kerberos, NTLM, OAuth2, OIDC, SAML)

• Ability to investigate identity compromises: compromised accounts, privilege escalation, credential theft, lateral movements and abuse of authentication mechanisms

Appreciated skills

• Experience in Threat Hunting

• Knowledge of cloud (Entra ID, M365, Azure)

A plus

• Knowledge of SOAR mechanisms

• PowerShell scripting

• Python scripting

• Knowledge of forensic tools

Personal qualities

• Analytical mind and ability to investigate methodically

• Curiosity and passion for technical research

• Rigor and quality of documentation

• Ability to communicate and work with multidisciplinary teams

• Autonomy and ability to work under pressure during incidents