S

Schneider Electric

Global energy management and automation provider

Cybersecurity Incident Response Engineer

Security Operations & Incident ResponseUpdated on Nov 9
Full-timeBarcelona, SpainNo salary listed

About the Job

Requirements

  • 2–4 years of professional experience in cybersecurity operations, incident response, SOC operations, infrastructure security, or a closely related discipline.
  • Hands-on experience investigating security events and coordinating technical response actions in an enterprise IT environment.
  • A technical background in computer science, information technology, cybersecurity, engineering, or a related discipline, or equivalent practical experience.
  • Ability to manage assigned incidents with limited supervision while recognizing escalation thresholds and decision boundaries.
  • Working proficiency in written and spoken English.
  • Ability to use incident response tools for incident detection, investigation, response coordination, forensic triage, and indicator analysis.
  • Ability to investigate security monitoring and SIEM alerts, correlate events, build basic queries, and reconstruct incident timelines.
  • Ability to interpret endpoint alerts, process activity, persistence indicators, and host containment actions.
  • Understanding of account compromise, MFA abuse, privileged access, suspicious sign-ins, and session or token risks.
  • Understanding of network protocols, firewalls, proxies, IDS/IPS, WAF, DNS, and network evidence used during investigations.
  • Ability to understand Windows environments, users, services, processes, event logs, and common security artefacts.
  • Understanding of Linux operating-system concepts, logs, permissions, services, and command-line usage.
  • Understanding of cloud concepts, audit logs, identity controls, and common security services in Azure and AWS.
  • Ability to understand vulnerability impact, exploitability, affected scope, remediation status, and risk-based prioritization.
  • Ability to interpret threat reporting and indicators in support of a specific investigation.
  • Understanding of evidence preservation, artefact review, chain of custody, and criteria for specialist escalation.
  • Ability to use Python, PowerShell, Bash, KQL, APIs, or similar tools for repeatable investigation and reporting tasks.
  • Understanding of controlled use of AI tools for summarization, enrichment, and repetitive analytical tasks.
  • Ability to investigate incidents using SIEM, EDR, identity, network, cloud, email security, and case-management tools.
  • Ability to create or adapt basic hunting queries and scripts to collect, normalize, correlate, or summarize investigative data.
  • Ability to use approved automation and AI-assisted capabilities under established governance and review controls.
  • Structured, methodical, and accountable case handling and evidence documentation.
  • Ability to remain calm, prioritize effectively, and make sound operational decisions during time-sensitive situations.
  • Ability to explain technical findings and required actions to different audiences.
  • Ability to collaborate across regions, functions, and technical domains.
  • Careful handling of confidential information and ethical evidence practices.
  • Ability to receive guidance from senior responders and escalate cases that exceed the role scope.

Responsibilities

  • Execute the end-to-end incident response lifecycle for assigned cybersecurity incidents within one region.
  • Review security alerts and reported events to determine whether they represent a cybersecurity incident.
  • Assess severity, affected assets, users, business scope, and potential impact using established classification criteria.
  • Collect and analyze relevant evidence, including SIEM events, endpoint telemetry, identity and sign-in data, email artefacts, network logs, cloud activity, and indicators of compromise.
  • Develop and document an investigation timeline, working hypotheses, findings, and technical conclusions.
  • Escalate promptly when evidence indicates high impact, cross-regional scope, legal or privacy implications, or the need for specialist forensic analysis.
  • Coordinate containment actions with SOC, endpoint, identity, messaging, network, cloud, infrastructure, and application teams.
  • Use approved playbooks and response procedures to reduce exposure while preserving relevant evidence.
  • Track assigned remediation and recovery actions through completion and validate that agreed technical measures have been implemented.
  • Maintain accurate and timely case records, including actions taken, evidence reviewed, decisions, owners, and status updates.
  • Provide clear technical summaries for technical and non-technical stakeholders in English.
  • Coordinate with regional Digital Risk Leaders, CISOs, SOC, Cyber Defense, Infrastructure, Identity, Forensics, Threat Intelligence, Privacy, and other teams as required by each case.
  • Participate in handovers and operational reviews to support continuity of response across time zones.
  • Contribute factual input to post-incident reviews and lessons learned.
  • Share recurring operational observations with senior responders and detection or engineering teams for further assessment.

Desired Qualifications

  • Experience with Microsoft security technologies, KQL, endpoint detection and response, cloud security monitoring, or identity investigation.
  • Exposure to case management, forensic triage, vulnerability management, threat intelligence, or phishing and account-compromise investigations.
  • Experience with scripting, data analysis, APIs, or automation workflows.
  • Relevant certifications such as GCIH, GCFA, Security+, or SC-200, or equivalent.

About the Company

Schneider Electric

Global energy management and automation provider

Schneider Electric is a global specialist in energy management and automation. It helps homes, businesses, and industries run electricity more efficiently by selling electrical products, automation hardware, software, and related services. Its offerings cover electrification, automation, and digitization, and solutions connect devices, collect data, and control systems to optimize energy use in smart industries, resilient infrastructure, and data centers. The company distinguishes itself with a broad, end-to-end portfolio and a worldwide presence in over 100 countries, combining hardware, software, and services to address sustainability and reliability. Its goal is to help people and organizations use energy more efficiently, reduce environmental impact, and improve uptime and reliability.

Company size
10,001+
Company stage
IPO
Headquarters
Rueil-Malmaison, France
Founded
1836

Recently Posted Jobs

Explore more opportunities at Schneider Electric

See more jobs