Incident Response Analyst

About this role

Talentgrator is a recruitment and talent partner focused on the IT entertainment and iGaming sectors, connecting businesses with specialized professionals. We work with teams that need strong technical expertise and dependable execution in fast-moving environments where security, resilience, and operational discipline matter every day.
We are looking for an Incident Response Analyst to join our Security team and operate on the front line of protecting the company’s infrastructure and services. This role is for someone who goes beyond simply reviewing alerts — you investigate incidents deeply, build detection logic, and help reduce response time proactively while strengthening the team’s ability to respond to threats with speed and clarity.
Responsibilities
Work with WAF to analyze anomalous traffic, respond to web attacks, and fine-tune rules.
Work with DLP and MDM to investigate data leaks, analyze policy violations, and collaborate with teams on findings.
Monitor and triage alerts in SIEM, analyzing events, classifying incidents, and prioritizing response.
Integrate new log sources into SIEM, including normalization, parsing, and enrichment.
Develop and improve detection rules, correlation rules, and dashboards.
Reduce MTTR by identifying bottlenecks in response processes and implementing automation and runbooks.
Participate in incident post-mortems and provide actionable recommendations.
Conduct security incident investigations by collecting artifacts, reconstructing timelines, and performing root cause analysis.
Requirements
What We Expect
3+ years of experience in Incident Response or Security Operations
Hands-on experience with SIEM platforms (Splunk, ELK/OpenSearch, Graylog, or similar)
Ability to read and interpret logs: OS (Linux/Windows/macOS), network, applications, cloud
Understanding of network protocols and traffic analysis (Wireshark, Zeek, etc.)
Knowledge of attacker tactics and techniques (MITRE ATT&CK, kill chain, IOC/TTP)
Ability to independently lead investigations from alert to final report
Scripting skills for automation (Python / Bash)
Basic understanding of integrating LLM-based tools
Native-level Russian proficiency

Nice to Have
Experience with SOAR platforms and building playbooks
Experience with EDR/XDR solutions (CrowdStrike, SentinelOne, etc.)
Participation in CTFs, red team / blue team exercises, or pentesting
Experience with cloud logs (AWS CloudTrail, GCP Audit Logs, etc.)
Experience integrating security tools via APIs and automating response using LLM
Benefits
25 vacation days and 5 family days yearly
Flexible start to the workday
Support from a professional corporate coach and psychologist
Regular internal and external activities, workshops, trips, and corporate events
Access to our internal knowledge base, meetups, and team-building activities
Ongoing training in new technologies and continuous professional development support