Incident Responder

Incident Responder (Tier 2)

UnderDefense is looking for a proactive, technically skilled Incident Responder (Tier 2) to join our Security Operations team. This is a hands-on, client-facing role where you'll take ownership of real-world cybersecurity incidents, lead investigations, make critical response decisions, and help enterprise clients navigate complex security threats.

You'll work across diverse environments, investigating everything from sophisticated infrastructure compromises to active attacks requiring immediate containment. As part of a team supporting 70+ clients, you'll collaborate with SOC Analysts, Security Engineers, and other security specialists while taking the lead when incidents occur.

This role is ideal for someone who enjoys solving complex security problems, taking ownership under pressure, and making a real impact when it matters most.

What You Will Do

• Investigate security alerts escalated from Tier 1, determine whether they constitute actual incidents, and decide on appropriate response actions.

• Review the quality of Tier 1 alert triage, including True Positive and False Positive classifications, and support analysts with complex investigations.

• Independently validate findings from our AI agent, MAXI, and Tier 1 analysts against raw security data, documenting your conclusions in incident tickets.

• Own incidents end-to-end as the assigned Incident Responder, activating incident response procedures, assessing severity, defining investigation plans, and driving the response process.

• Lead incident response calls with clients, coordinate with their technical teams, involve relevant security specialists, and assign investigation and remediation tasks.

• Maintain incident trackers, provide daily updates to clients during active incidents, and prepare comprehensive incident reports.

• Share Indicators of Compromise (IoCs) and affected asset information with the SOC team to support further detection and monitoring.

• Respond to client-reported compromises and security investigation requests.

• Conduct proactive and client-requested threat hunting, including investigations triggered by newly discovered vulnerabilities or emerging threats.

• Analyze suspicious files, email samples (.eml), IP addresses, and domains submitted by clients through MAXI.

• Perform daily health checks to identify security alerts that may not have been properly ingested into MAXI or Jira.

• Prepare and deliver weekly and monthly security reports to assigned clients, including presenting findings and recommendations in English.

What We're Looking For

• Ability to independently manage security incidents and communicate directly with clients.

• Experience investigating complex security incidents involving actual infrastructure compromise and attacker activity within corporate environments.

• Windows and Linux forensics.

• Hands-on experience investigating security incidents in at least one cloud environment, such as AWS or Microsoft Azure.

• SIEM and EDR expertise.

• Strong analytical and problem-solving skills.

• Ability to explain complex security incidents clearly, coordinate multiple stakeholders, and guide clients through high-pressure situations.

• Strong English communication skills.

Nice to Have

• Knowledge of Kubernetes and experience investigating security incidents in containerized environments.

• Experience developing AI agents or AI-powered workflows for cybersecurity tasks, such as alert triage, phishing analysis, or security investigations, with testing against real-world data.

• Experience with tools and technologies such as LibreChat, MCP servers, Claude, or OpenAI API.

What You'll Get at UnderDefense

• Real-world incidents that actually challenge you.

• Work across different enterprise infrastructures, security stacks, cloud environments, and attack scenarios, constantly expanding your technical expertise.

• A strong team of cybersecurity professionals.

• Competitive compensation and challenging projects.

• Flexible working hours.

• Paid vacation and sick leave.

• Continuous learning opportunities, including internal training, workshops, conferences, and professional development activities.

• English language courses.

• Work-life balance support, including office activities, foosball, and a workout station.

Ready to take ownership when it matters most?

Send your CV to ulyana.volynets@underdefense.com and join the UnderDefense team!