Tier 2 Cyber Defense Analyst – Incident Analysis

Vision Cybersecurity

. Process, analyze, and manage cybersecurity requests, incidents, problems, and tasks .

Posted 9/26/2026full-timeRemote • BrazilJuniorMid-LevelWebsite

Tech Stack

Tools & technologies

AzureFirewalls

About the role

Key responsibilities & impact

Process, analyze, and manage cybersecurity requests, incidents, problems, and tasks
Perform advanced analysis of events and alerts from SIEM, EDR, firewalls, IDS/IPS, proxy, Active Directory, and other telemetry sources
Correlate events to identify malicious behavior
Investigate incidents, including IOCs, TTPs, lateral movement, privilege escalation, persistence, and potential data exfiltration
Participate in crisis rooms (war rooms) for high-severity incidents
Contribute to the containment, eradication, mitigation, and recovery of compromised environments
Analyze firewall logs, blocks, suspicious sessions, C2 communications, exploitation attempts, lateral movement, and exfiltration
Support DFIR operations by preserving and collecting evidence
Prepare technical and executive incident reports
Maintain technical and formal communication with clients and internal teams during incidents
Conduct proactive threat hunting
Develop, review, and update playbooks, runbooks, procedures, knowledge bases, and response workflows
Support the evolution of detection use cases, correlation rules, and response automations
Contribute to KPIs such as MTTD, MTTA, MTTR, false-positive rate, and operational efficiency
Perform advanced incident triage, classification, prioritization, and escalation
Execute immediate containment, including host isolation, IOC blocking, and revocation of compromised credentials
Conduct EDR, firewall, and SIEM investigations without direct supervision in medium- and high-complexity scenarios
Request emergency blocks in security controls
Propose improvements to detection rules, playbooks, processes, and cyber defense policies
Provide technical support to the Tier 1 team for complex escalations
Validate indicators of compromise and recommend engaging specialized teams
Participate in technical decision-making during critical incidents

Requirements

What you’ll need

A bachelor’s degree in Information Technology or another field is preferred
At least 2 years of proven experience in information security operations, maintenance, and support
Knowledge of information security, computer networks, and IT infrastructure
Experience with or knowledge of security event triage and analysis, monitoring, and threat and attack detection using tools such as SIEM is preferred
Knowledge of CIS, MITRE ATT&CK, NIST, and ISO 27001
Ability to create and update security procedures, processes, and documentation
Knowledge of authentication, authorization, and cryptography is preferred
Experience with or knowledge of identity and access management, Azure AD, firewalls, IDS/IPS, and VPNs
Intermediate English proficiency for technical communication and documentation
Strong communication skills for interacting with clients, internal teams, and partners
Ability to work with DDoS mitigation solutions
Knowledge of SSL, TLS, and HTTPS

Benefits

Comp & perks

Bradesco Top Nacional health insurance
Odontoprev dental insurance
Life insurance
Pipo Saúde
TotalPass
Public transportation allowance
Alelo Tudo: meal and food benefits on a single card
Private pension plan with a 2:1 employer matching contribution
Birthday day off
Employee referral program
Discounts at educational institutions
Vision Baby Kit
Exclusive discounts through the SESC group
Welcome kit
Morning and afternoon coffee with fruit on in-office days
DeepLearning: Corporate University
Professional growth opportunities
Feedback and development culture
Exclusive leadership program
Relaxed and innovative environment
Accessible leadership