Senior SOC L3 / CSIRT Incident Response Coordinator

We are looking for a highly experienced Senior SOC L3 / CSIRT Incident Response Coordinator to join a challenging cybersecurity project within a critical infrastructure environment in Brussels.

This position combines advanced technical expertise in cybersecurity incident response with operational leadership, cross-functional coordination and continuous improvement of security operations.

You will play a key role in managing complex cybersecurity incidents across IT and Operational Technology (OT) environments, ensuring effective collaboration between SOC teams, technical specialists and business stakeholders.

Key Responsibilities

• Lead and coordinate end-to-end cybersecurity incident response activities, from initial triage and investigation through containment, eradication, recovery and post-incident review.
• Act as the highest technical escalation point (SOC Level 3), conducting in-depth investigations and assessing security threats and their operational impact.
• Coordinate SOC analysts, incident response teams, IT/OT specialists and external stakeholders during security incidents.
• Provide technical leadership and support effective team management during critical incidents.
• Develop, maintain and continuously improve incident response procedures, playbooks and operational processes.
• Coordinate threat analysis, vulnerability remediation and incident follow-up activities.
• Support cybersecurity operations in OT/ICS environments, taking into account operational continuity and availability requirements.
• Monitor incident response performance, produce structured reports and contribute to continuous SOC/CSIRT maturity improvements.
• Collaborate with engineering teams to enhance SIEM/EDR detection capabilities, monitoring coverage and security use cases.
• Organise and participate in cybersecurity exercises, incident simulations and lessons-learned activities.

Required Qualifications & Experience

• Minimum 10 years of professional experience, with substantial experience in cybersecurity operations and incident response.
• Proven hands-on experience in SOC Level 3 (L3) activities, including advanced threat investigation and incident escalation.
• Demonstrated experience in team management and operational coordination within SOC, CSIRT or cybersecurity incident response environments.
• Mandatory experience in Operational Technology (OT/ICS) cybersecurity.
• Strong understanding of incident response methodologies, threat detection, containment, remediation and recovery.
• Solid technical knowledge of enterprise cybersecurity, network security, identity and access management, logging and security monitoring.
• Ability to coordinate multiple technical teams and stakeholders under pressure.
• Strong analytical, problem-solving, communication and documentation skills.
• Fluent English and professional proficiency in French or Dutch.
• European passport required.

Nice to Have

• Experience in the defence, railway or critical infrastructure sectors.
• Knowledge of Microsoft security technologies, including Microsoft Defender and Entra ID, or equivalent enterprise security solutions.
• Familiarity with SIEM, EDR, threat hunting and digital forensics.
• Knowledge of NIST incident response practices and MITRE ATT&CK.
• Experience with Azure DevOps, security use case management and SOC process improvement.
• Professional proficiency in both French and Dutch.
• Relevant cybersecurity certifications such as GCIH, GCFA, CISSP or equivalent.

What We Offer

An opportunity to contribute to a long-term cybersecurity mission within a complex, business-critical infrastructure environment.

You will work alongside experienced cybersecurity professionals, combining advanced technical incident response with operational leadership and continuous security improvement.

The position is open to both freelance professionals and candidates seeking permanent employment, with a hybrid working arrangement in Brussels.

Interested?

If you have a strong background in SOC L3 operations, hands-on incident response, team leadership and OT cybersecurity, we'd love to hear from you.

Apply now to discuss this opportunity!