Incident Response Analyst (L2)

About the role

SoftSwiss is seeking an Incident Response Analyst (Level 2) to join its Security Operations team. You will lead investigations of complex security incidents, support L1 analysts, and help evolve the organisation’s detection and response capabilities.

Key responsibilities

• Investigate and respond to advanced security incidents throughout the full incident lifecycle.
• Conduct digital forensic investigations, malware analysis and evidence collection to determine scope and root cause.
• Analyse attack techniques, correlate events and reconstruct attack timelines using frameworks such as MITRE ATT&CK and the Cyber Kill Chain.
• Develop and refine SIEM detections, correlation rules and incident‑response playbooks.
• Perform threat‑hunting activities and reduce false positives through detection tuning.
• Automate repetitive SOC tasks with scripting (Python, PowerShell, Bash).
• Collaborate with Infrastructure, Development, IT and Security teams during incident response.
• Mentor and guide L1 analysts, providing technical feedback and knowledge transfer.

Required profile

• Minimum 3 years of experience in a SOC, Incident Response, DFIR or MSSP environment.
• Strong understanding of modern cyber threats, attack techniques and relevant frameworks.
• Hands‑on experience investigating incidents, performing forensics and malware analysis.
• Effective communication skills and ability to work cross‑functionally.

Required skills

• SIEM platforms – Splunk, Wazuh, ClickHouse, Redash.
• Scripting – Python, PowerShell, Bash.
• Operating systems – Windows, Linux, macOS.
• Enterprise technologies – Active Directory, email systems, Kubernetes, Docker, databases.
• Frameworks – MITRE ATT&CK, Cyber Kill Chain.
• Digital forensics and malware analysis techniques.

What we offer

• Private health insurance and sports benefits.
• Comprehensive mental‑health program.
• Free English lessons and local language courses.
• Paid time off, maternity‑leave support and referral rewards.
• Upskilling opportunities, internal workshops and conference participation.