Incident Response Analyst (Duty)

Location: Worldwide, fully remote. The company hires specialists who have already relocated from Russia or Belarus.

Salary: €2,500–€3,500 gross per month

Company

Entertainment-sector company with an internal security incident response function.

What you will do

• Participate in security incident response and perform basic primary triage.
• Monitor alerts in compliance with SLA and investigate indicators of compromise using publicly available tools.
• Execute and monitor tasks resulting from incident response planning.
• Develop and update alert-verification playbooks and incident response instructions.
• Propose improvements to security tools and operational processes.
• Work a 2-on-2-off schedule: a 12-hour day shift, a 12-hour night shift the next day, followed by two days off.

Requirements

• Basic IoC analysis skills using tools such as VirusTotal and ANY.RUN.
• Experience with Splunk, ClickHouse, and SQL, including writing simple search queries and interpreting results.
• Experience with SOAR/IRP and a general understanding of current cyber threats and common attack methods.
• Basic programming skills in Python, PowerShell, or Bash for automating routine tasks.
• Knowledge of Linux and Windows at a junior system administrator level.
• Understanding of the MITRE ATT&CK framework and Cyber Kill Chain.
• Ability to analyze and process large volumes of data, including logs and triage results.
• Strong communication, teamwork, analytical thinking, flexibility, proactivity, ownership, and willingness to develop professionally.

Nice to have

• Knowledge of information security best practices such as NIST and ISO.
• Basic Docker and Kubernetes knowledge, including monitoring features.
• Experience writing SIEM correlation rules, using NTA and online reputation services, and developing alert-verification or incident-response scenarios.
• Experience with Kafka, ELK, Graylog, log collection and normalization, and CI/CD, software development lifecycle, or Infrastructure-as-Code tools such as Terraform and Ansible.
• Strong Linux administration, network, host, and cloud investigation experience.
• Knowledge of endpoint and infrastructure security tools such as auditd, Sysmon, AppArmor, and SELinux.
• Fundamental static and dynamic malware analysis skills and offensive security experience, including penetration testing or red teaming.

Culture & Benefits

• Fully remote work available worldwide.
• Gross monthly salary of €2,500–€3,500.
• 2-on-2-off 12-hour day and night shift schedule.