Incident Response & DFIR

We are inviting you, a highly motivated and results-oriented Incident Response & DFIR Lead to join our team on a full-time basis.

Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.

Responsibilities

• Lead incident response, containment and forensic coordination for confirmed security incidents
• Act as Incident Commander for major security incidents within the defined authority model
• Assign incident roles and maintain clear ownership of investigation, containment and recovery actions
• Maintain incident timelines, evidence logs, decision logs and action tracking
• Coordinate investigation across endpoints, servers, identities, cloud platforms, SaaS environments and relevant network telemetry
• Direct forensic collection and analysis required to determine attack path, scope, persistence and impact
• Coordinate containment actions with IAM, Platform, IT, Security Engineering, Product and other technical owners
• Recommend high-impact containment decisions to the Group Manager of Cyber Defense and CISO where required
• Coordinate eradication and recovery activities and ensure systems return to a sufficiently trusted state
• Ensure relevant evidence is preserved for Legal, HR, regulatory, disciplinary and post-incident requirements
• Maintain practical forensic and evidence-handling standards
• Develop and maintain incident playbooks, forensic checklists and containment procedures
• Lead post-incident reviews and root-cause analysis
• Ensure post-incident remediation actions have accountable owners, due dates and follow-up
• Identify telemetry, detection and forensic-readiness gaps exposed during investigations
• Convert investigation findings into recommendations for Detection Engineering, IAM, Security Engineering, Product Security and other control owners
• Support incident exercises and readiness testing
• Develop and mentor Incident Response / DFIR Specialists
• Coordinate with external forensic, incident-response or specialist providers where required
• Provide concise incident updates to Cyber Defense leadership, CISO and relevant stakeholders

Requirements

• Strong hands-on knowledge of the incident response lifecycle: investigation, containment, eradication, recovery and lessons learned