Cybersecurity Incident Coordination & Automation Engineer

• Educational Qualifications: Bachelor's degree (Master's preferred) in Information Technology (e.g., Computer Science, Electrical Engineering, Telecommunications, Information Security);
• Professional experience: between 2-5 years in a SOC environment, detection engineering, or incident response;
• Proven experience in detection engineering and/or automation (SOAR);
• Solid knowledge of Microsoft Sentinel and Microsoft 365 Defender;
• Proficiency in KQL and scripting (e.g., Python, PowerShell);
• Knowledge of MITRE ATT&CK and threat hunting / purple teaming methodologies;
• Familiarity with Information Security Management Systems (ISMS/ISMM) and reference frameworks (e.g., ISO/IEC 27001);
• Knowledge of applicable regulatory requirements (NIS2, EASA PART-IS, GDPR) and reporting obligations to authorities;
• Knowledge of Operating Systems (e.g., Windows, Linux) and Networking;
• Proficiency in spoken and written Portuguese and English.

Preferred Requirements:

• Previous experience in the aviation sector or in critical infrastructures / highly regulated environments;
• Relevant certifications (e.g., Microsoft SC-200, AZ-500, SC-100; GIAC GCDA/GCIA; ISO/IEC 27001 Lead Implementer/Auditor);
• Experience in Infrastructure as Code (IaC) and in CI/CD for detection-as-code;
• Experience in vendor/MSSP governance and in audit preparation;
• Knowledge of FinOps practices applied to SIEM.

The Cybersecurity Incident Coordination & Automation Engineer is responsible for coordinating incident response and for designing, implementing, and verifying the SOC's detection and response automation capabilities. They monitor and support the review of metrics for services provided by the MSSP. They ensure the alignment of cybersecurity operations with the Information Security Management Manual (ISMM) and with the regulatory requirements applicable to the aviation sector (NIS2, EASA PART-IS, GDPR).

• Coordinate the response to information security incidents throughout their lifecycle, in accordance with established procedures;
• Design, develop, and maintain detection rules (detection-as-code) mapped to MITRE ATT&CK, in Microsoft Sentinel and Microsoft 365 Defender;
• Develop and maintain response automations (SOAR) — Logic Apps, playbooks, and integrations (e.g., ITSM) — reducing MTTR and manual effort;
• Execute Detection Assurance activities: purple teaming, technical auditing of the MSSP, hunting for false negatives, and coverage validation;
• Direct and verify MSSP performance through metrics, leading service reviews and ensuring compliance with SLAs;
• Ensure operational quality (QA) of incident handling and adherence to playbooks;
• Guarantee the alignment of processes with the Information Security Management Manual (ISMM) and contribute to its update;
• Ensure compliance with regulatory obligations and reporting to authorities (ANAC, EASA, CNCS, CNPD), in the context of NIS2, EASA PART-IS, and GDPR;
• Onboarding and governance of log sources and cost optimization of the SIEM platform (FinOps Sentinel);
• Produce operational indicators and evidence of compliance for audits;
• Support the development and maintenance of operational documentation (playbooks, runbooks, RACI).

Noesis is looking for the following profile: