Monitor security events using SIEM and other security tools, performing initial triage and correlating signals across multiple sources.
Execute incident response activities, including detection, investigation, containment, remediation, and documentation of security incidents.
Analyze alerts and security anomalies to identify legitimate threats, false positives, and situations that require escalation.
Perform perimeter protection activities, maintaining continuous oversight of firewalls, IDS/IPS, and other boundary security technologies.
Conduct in-depth investigations following defined processes and playbooks, ensuring consistent and high-quality incident handling.
Support enhancements to security monitoring, detection logic, and Blue Team processes.
Collaborate with internal teams to implement improvements to policies, controls, and procedures.
Test and validate new tools and technologies to strengthen threat detection and response capabilities.
Produce clear and structured reports on incidents, findings, and remediation steps.
Contribute to continuous learning by staying up to date on cybersecurity trends, threat actors, and defensive techniques.

Be based in Brazil
English level: B1
Previous experience working in a Blue Team, CSIRT, SOC, or other security area
Experience in incident response, alert triage, investigation, and remediation, following defined processes and playbooks
Experience with security monitoring / SIEM and event correlation; ability to identify false positives
Knowledge of log ingestion and use; data quality validation
Understanding of relevant fields/attributes for detection
Knowledge of cloud environments and networking
Familiarity with MITRE ATT&CK, Cyber Kill Chain, and incident response frameworks

Associate Cybersecurity Analyst

Key skills