Senior Security Engineer - CSIRT

Accountabilities:: Act as the primary technical point of contact for Level 2 and Level 3 security incidents, leading response efforts across complex and high-criticality environments. Coordinate incident response activities with MSSPs and 24/7 SOC teams, ensuring operational quality, alignment, and continuous improvement. Collaborate rapidly with multicultural teams and multiple business functions, including Legal, Data Protection, Communications, and cybersecurity teams, throughout security incidents. Develop, maintain, and continuously improve Incident Response playbooks, procedures, and workflows, incorporating automation wherever possible. Lead Digital Forensics and Incident Response activities, including investigation of root causes, assessment of compromise scope, evidence analysis, and post-incident reviews. Drive post-mortem processes by facilitating technical discussions, documenting findings, and translating incidents into actionable improvements. Apply advanced threat detection expertise to create, tune, and enhance detection rules across SIEM and EDR platforms. Manage the full Cyber Threat Intelligence lifecycle, transforming threat data into actionable intelligence that strengthens SOC operations and defensive capabilities. Partner with Tier 1 and Tier 2 vendors to optimize operational routines, improve service delivery, and maximize the value of security contracts. Requirements: At least 5 years of professional experience focused on Incident Response, Digital Forensics, or Threat Hunting. Strong hands-on expertise in Digital Forensics and Incident Response, including the preservation, collection, acquisition, and analysis of digital evidence. Experience investigating systems and networks across Windows, Linux, and macOS environments. Proficiency with memory forensics and host-based forensic tools. Ability to conduct basic static and dynamic malware analysis to identify Indicators of Compromise (IoCs) and understand malicious capabilities. Proven experience leading incident response activities in cloud environments, particularly AWS and GCP. Practical experience with Security Orchestration, Automation and Response (SOAR), including developing automated workflows that improve incident response efficiency. Strong risk assessment and prioritization skills, with the ability to allocate resources and make effective decisions during high-pressure situations. Excellent communication and leadership abilities, including the capacity to clearly explain technical findings to both technical specialists and executive stakeholders. Benefits: Competitive salary. Profit-sharing opportunities. Meal allowance. Health insurance. Dental plan. Life insurance. Childcare subsidy and atypical parenthood subsidy. Wellhub membership. Home office allowance. Employee assistance program covering mental health, social, legal, and financial support. Extended parental leave. Day off for your birthday, Mother’s Day, and Father’s Day. Benefits Club with discounts on everyday services. Discounts at educational institutions. Reading kit for children through PlayKids. Remote-first work model, with the option to work from anywhere in Brazil. Access to São Paulo offices or partner coworking spaces up to twice per week.