← All roles

Security Operations & Incident Response Analyst

Aleph Holding· Information Technology
Apply on company site
Hybrid (Madrid)€48k+Full-timePosted 3w ago

About the role

Security Operations & Incident Response Analyst (L3) to join Aleph's global IT Security team in Madrid, hybrid, full-time. You will own end-to-end incident response, lead threat hunting and intelligence activities, and manage vulnerability and IAM programs across a globally distributed environment.

Responsibilities

  • Own and coordinate the end-to-end incident response process: identification, triage, containment, eradication, recovery, and post-incident review (lessons learned).
  • Serve as the primary point of contact for security incidents escalated from IT Operations, the Security Engineer, and external sources.
  • Maintain and continuously improve incident response playbooks for relevant threat scenarios (ransomware, phishing, account compromise, data breach, insider threat, etc.).
  • Manage the security incident log and register: track incidents, document timelines/actions, and produce trend analysis and reporting for the CISO.
  • Coordinate with external SOC or MDR providers: review daily reports, validate alert quality, and manage escalation workflows.
  • Lead data breach investigations: scope the breach, gather/preserve evidence, assess PII exposure, and coordinate with Legal/Privacy/HR; produce breach investigation reports with findings and recommendations.
  • Conduct proactive threat hunting: develop hypotheses from threat intelligence, search for IoCs, investigate anomalous behaviour.
  • Manage Threat Intelligence: track threat actors, MITRE ATT&CK techniques, and campaigns; integrate intelligence into SIEM/XDR detection rules and hunting queries; produce summaries for stakeholders.
  • Own vulnerability management: schedule/execute scans across infrastructure, endpoints, and cloud; prioritise findings; coordinate remediation; track metrics; re-scan and spot-checks.
  • Manage IAM: periodic access reviews with system owners/HR; oversee PAM policies and privileged account reviews; investigate identity-related anomalies.

Qualifications

  • 3–5 years in a SOC analyst, incident response, or security operations role, with at least 1–2 years at L3 level is a plus.
  • Experience implementing or managing IAM and PAM solutions
  • Experience in international or multinational environments.
  • Hands-on incident response engagements (internal or consulting) valued.
  • Certifications: GCIH, GCFE, GCFA, CEH, CompTIA CySA+, or equivalent; OSCP a plus.
  • Strong hands-on experience with SIEM platforms and EDR/XDR tools.
  • Solid knowledge of MITRE ATT&CK and its application to threat hunting/IR.
  • Experience with vulnerability scans (Tenable Nessus, Qualys, Rapid7, or similar).
  • Familiarity with IAM and PAM concepts and platforms (e.g. CyberArk, BeyondTrust, Azure PIM).
  • Experience with DFIR methodologies: evidence collection, log analysis, timeline reconstruction.
  • Knowledge of threat intelligence platforms/feeds (MISP, VirusTotal).
  • Understanding of ISO 27001 incident management controls, NIS2 incident reporting, and PCI DSS 12.10.
  • Calm under pressure; strong investigative mindset and documentation skills.
  • Ability to communicate incident status to technical and executive stakeholders.
  • Collaborative and proactive, comfortable working asynchronously across time zones.
  • English: full professional proficiency (C1/C2); Spanish proficiency a plus.

Skills

Required:Incident responseSIEMEDR/XDRThreat huntingVulnerability managementIAM & PAM
Nice to have:DFIR
Last updated Oct 21, 2026. Interested? Apply on the company site.

About Aleph Holding

Aleph is making digital advertising accessible around the world

A leading global enabler of digital advertising in emerging countries

digital advertisingemerging marketstechnologypaymentssolutions
Company profileWebsite

More open roles at Aleph Holding