Cybersecurity Incident Responder

About the role

We are seeking a hands‑on Cybersecurity Incident Responder to join a coordinated team supporting a major EU agency. The role is based onsite in Valletta and works across hybrid on‑premise and cloud environments, protecting critical systems and data.

Key responsibilities

• Monitor, triage and respond to security events using XDR/SIEM platforms.
• Detect anomalies, identify attack patterns and assign severity based on business impact.
• Lead in‑depth investigations, including root‑cause analysis, scope definition and proactive threat hunting.
• Drive containment, eradication and recovery actions, coordinating with internal and external stakeholders.
• Develop and improve detection engineering: correlation rules, use cases, SOAR playbooks and automated response workflows.
• Collect and preserve digital evidence following forensic best practices.
• Produce clear, audit‑ready incident reports for management.
• Contribute to cybersecurity procedures, playbooks and technical standards.
• Deliver security awareness training and knowledge transfer to agency staff.

Required profile

• Minimum 2 years of post‑secondary education in a relevant field.
• At least 6 years of professional experience, with 3 + years in incident response or SOC roles.
• One recognized cybersecurity or product certification.
• English proficiency at B2 level or higher.
• EU‑member‑state nationality and high discretion due to handling sensitive data.

Required skills

• Hands‑on experience with SIEM/EDR/SOAR platforms (e.g., Palo Alto Cortex XDR, Splunk, Microsoft Sentinel, Palo Alto XSOAR).
• Writing detection content, correlation rules and SOAR playbooks.
• Familiarity with threat‑intelligence platforms such as MISP.
• Query‑language experience (XQL, KQL, SPL) and scripting in Python.
• Malware and suspicious‑file analysis, including sandboxing.
• Incident response and threat‑hunting across endpoints, networks, Windows, Linux and cloud.
• Working knowledge of Azure and/or AWS security, TCP/IP networking and digital‑forensics fundamentals.

What we offer

• Freelance agreement with a gross daily rate of €170.
• Onsite work in Valletta, Malta.