2 days ago

Senior Security Engineer, Security Incident Response Team (SIRT) - EMEA

GitLab

2 days ago

GitLab seeks a Senior Security Engineer for its Security Incident Response Team (SIRT) to lead incident response, improve detection and response capabilities, and scale security operations through automation. The role requires strong DFIR expertise, cloud security experience, and operates remotely within EMEA business hours.

AIRemoteFull-timeSeniorSecurity Incident ResponseDigital Forensics And Incident Response (DFIR)

Senior Security Engineer, Security Incident Response Team (SIRT) - EMEA

Apply

AIRemoteFull-timeSeniorSecurity Incident Response

Salary

Not specified

Work Location

Netherlands, NL

Work Model

Remote

Employment Type

Full-time

Experience Level

Senior

Core Qualifications

Technical (Must-have)

Security Incident ResponseDigital Forensics and Incident Response (DFIR)Cloud Platforms (AWS & GCP)SIEMEDRDetection EngineeringGit/GitLabPythonScriptingSOARThreat IntelligenceMITRE ATT&CKAutomationAI/MLRoot Cause Analysis

Soft Skills

AnalyticalProblem-solvingWritten CommunicationGrowth MindsetProactiveMentoring

Key Responsibilities

•Lead and coordinate end-to-end incident response for high-severity security events within a 24/7 global on-call model, operating during EMEA business hours
•Prepare clear executive communications that keep stakeholders informed during incidents
•Investigate complex security incidents across cloud environments, applying strong DFIR methodologies
•Partner with Signals Engineering to design and implement detection capabilities, including SIEM use cases, alerting strategies, and telemetry pipelines
•Build and enhance automation and AI-assisted workflows to improve triage, investigation speed, and response consistency
•Partner with Threat Intelligence to contextualize threats and improve detection coverage
•Conduct root cause analysis (RCA) and lead post-incident reviews to drive continuous improvement and risk reduction
•Develop and maintain runbooks, playbooks, and operational documentation
•Collaborate cross-functionally during incidents and lead proactive initiatives (e.g., tabletops)
•Mentor other engineers and help elevate the team's overall incident response maturity

SecurityIncident ResponseDFIRCloud SecurityAWSGCPSIEMEDRAutomationRemote

Core Qualifications

Technical (Must-have)

Soft Skills

AnalyticalProblem-solvingWritten CommunicationGrowth MindsetProactiveMentoring

Key Responsibilities

•Lead and coordinate end-to-end incident response for high-severity security events within a 24/7 global on-call model, operating during EMEA business hours

•Prepare clear executive communications that keep stakeholders informed during incidents

•Investigate complex security incidents across cloud environments, applying strong DFIR methodologies

•Partner with Signals Engineering to design and implement detection capabilities, including SIEM use cases, alerting strategies, and telemetry pipelines

•Build and enhance automation and AI-assisted workflows to improve triage, investigation speed, and response consistency

•Partner with Threat Intelligence to contextualize threats and improve detection coverage

•Conduct root cause analysis (RCA) and lead post-incident reviews to drive continuous improvement and risk reduction

•Develop and maintain runbooks, playbooks, and operational documentation

•Collaborate cross-functionally during incidents and lead proactive initiatives (e.g., tabletops)

•Mentor other engineers and help elevate the team's overall incident response maturity