Incident Eradication and Recovery Analyst (Mid-Level)

Solo Network

. Investigate security incidents using data from SIEM, EDR/XDR, network, and cloud environments.

Posted 10/27/2026contractSão Paulo • BrazilMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in incident response, including the investigation of security incidents, threat containment, and the development of detection rules. Proficient in utilizing SIEM and EDR/XDR tools, with a strong understanding of networking and cloud security.

Highest-signal resume keywords

Incident Response Lifecycle KnowledgeSIEM Tools ExperienceNetworking Protocols ExpertiseCloud Security KnowledgeDigital Forensics Skills

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

SIEMEDR/XDRNetworking: TCP/IP, DNS, HTTP/SMemory ForensicsDisk ForensicsLog AnalysisMalware AnalysisThreat IntelligencePythonPowerShell

Soft Skills

Analytical ThinkingCommunication SkillsDecision-Making

Tools & Technologies

Microsoft SentinelElasticGoogle SecOpsCrowdStrikeMicrosoft DefenderSentinelOneWiresharkTcpdump

Industry Keywords

NIST SP 800-61MITRE ATT&CKStandard Operating ProceduresIndicators of CompromiseSOAR

Tech Stack

Tools & technologies

AWSAzureCloudDNSFirewallsLinuxPythonTCP/IP

About the role

Key responsibilities & impact

Investigate security incidents using data from SIEM, EDR/XDR, network, and cloud environments.
Execute threat containment and eradication actions, taking business risks and impacts into account.
Perform the initial collection and preservation of digital evidence, including memory, disk, and network traffic.
Support technical war rooms during critical incidents, contributing analyses and information for decision-making.
Prepare post-incident reports covering the timeline, indicators of compromise (IOCs), root cause, and recommendations.
Create and improve detection rules and use cases on SIEM platforms.
Develop and maintain Standard Operating Procedures (SOPs) for incident response.
Support the implementation of connectors for log and event collection, expanding monitoring coverage.
Contribute to the creation and continuous improvement of playbooks and automations in partnership with senior analysts.

Requirements

What you’ll need

Hands-on experience with SIEM, EDR/XDR, and the analysis of system and network logs.
Strong knowledge of networking: TCP/IP, DNS, HTTP/S, VPNs, firewalls, proxies, IDS/IPS, and traffic analysis using Wireshark and tcpdump.
Knowledge of security and administration for Windows environments, Active Directory, Event Logs, and Sysmon, as well as Linux.
Knowledge of cloud security, especially Azure, AWS, and Google Cloud.
Knowledge of the incident response lifecycle, with reference to NIST SP 800-61, and the MITRE ATT&CK framework.
Experience with SIEM tools such as Microsoft Sentinel, Elastic, or Google SecOps, and EDR/XDR solutions such as CrowdStrike, Microsoft Defender, or SentinelOne.
Knowledge of memory and disk forensics, log analysis, and malware analysis.
Familiarity with Threat Intelligence, indicators of compromise (IOCs), and MISP.
Knowledge of SOAR and automation using Python or PowerShell.
Experience developing playbooks, operating procedures, and technical reports.
Advanced technical English proficiency, with strong reading and writing skills.
Currently pursuing or completed a degree in Information Technology, Computer Networks, Data Processing, Computer Science, Software Engineering, Systems Analysis and Development, or a related field.