Grant Thornton's Cyber Fusion Centre (CFC) is looking for an experienced CSIRT Incident Responder / Threat Hunter to protect enterprise systems by promptly responding to security threats. Acting as the incident response orchestrator, you will manage major escalations from the SOC, proactively hunt for threats, and collaborate across technical and business stakeholders to maintain the organization's robust security posture.

What You Will Do

- Major Incident Orchestration: Act as the lead incident response orchestrator during active security events. Launch Major Incident Management (MIM) bridges, assign containment actions, and coordinate cross-functional teams (SOC, Infrastructure, IAM, Legal, Privacy, etc.).
- Advanced Threat Hunting & Analysis: Proactively hunt for threats across cross-platform security tooling. Perform static/dynamic analysis on malware samples and PCAPs to extract network Indicators of Compromise (IOCs).
- End-to-End Incident Lifecycle: Monitor CSIRT trigger channels, validate business impact and severity, guide forensic evidence preservation, oversee short- and long-term containment, and conduct root cause analysis.
- Stakeholder Communication: Maintain real-time incident timelines, brief executive and technical stakeholders on MIM calls, and produce thorough post-incident reports and corrective action plans.




- Continuous Improvement: Recommend SIEM detection enhancements, fine-tune alerts, improve response playbooks, and identify and mitigate vulnerabilities and attack paths.

What You Bring

- Experience: 6+ years in cybersecurity, SOC operations, or threat hunting, coupled with 2+ years of dedicated experience in Major Incident Management (MIM) within a 24x7 CSIRT/MSSP or enterprise environment.
- Technical Proficiency: Deep expertise handling endpoint security incidents (e.g., malware infections, credential theft, lateral movement, persistence). Experience with CrowdStrike Falcon Next-Gen SIEM/EDR and SOAR orchestration is highly preferred.
- Analytical Skills: Solid understanding of the MITRE ATT&CK; framework and the incident response lifecycle. Proven ability to make calm, structured decisions under high-pressure scenarios.
- Education: Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or equivalent practical incident response experience.
- Certifications (Preferred): GIAC Certified Incident Handler (GCIH), CrowdStrike Certified Falcon Responder (CCFR), or CrowdStrike Certified Falcon Hunter (CCFH).

Ready to lead the response against advanced cyber threats?

📌 Incident Manager (Bogotá)
🏢 Auxis
📍 Bogotá