Cyber Incident Response Analyst

As an Incident Response Analyst, you will help protect Fever's technology environment by triaging and investigating security alerts, responding to incidents across our cloud and endpoint estate, and building automation that makes our detection and response capability faster and more consistent.

Working within the Cyber Incident Response team, you will own the alert lifecycle from initial detection through investigation, containment, and documentation, while contributing to the continuous improvement of our detection rules and SOAR playbooks. The ideal candidate combines strong hands-on investigation skills with an automation-first mindset, enabling them to reduce manual toil, improve response times, and raise the overall maturity of our security operations.

In your first month at Fever:

• You will be fully integrated into the team. You will participate in planning and follow-up meetings with other areas.
• You will have met the departments of Fever.
• You will get familiar with Fever's technological structure and ecosystem (applications, cloud infrastructure, architecture, etc.)
• You will gain an understanding of our detection and response processes, security tooling (EDR, SIEM, SOAR, CNAPP), and overall threat landscape.
• You will shadow ongoing alert triage and incident investigations to learn our workflows, severity criteria, and documentation standards.

After 3 months in Fever:

• You will independently triage and investigate security alerts across endpoint, identity, SaaS, and cloud sources.
• You will participate in incident response activities, performing containment and remediation actions under established procedures.
• You will document investigations following our internal reporting and ticketing standards.
• You will identify false-positive patterns and propose tuning improvements to detection rules.
• You will contribute to the development and refinement of SOAR playbooks for common alert types.

On your 6th month in Fever:

• You will take end-to-end ownership of incident investigations, including escalation decisions.
• You will design and implement new SOAR automation workflows to reduce manual triage effort.
• You will contribute to detection engineering, proposing and building new correlation rules based on observed threats and gaps.
• You will participate in post-incident reviews and drive improvements to our response processes and playbooks.

• Triage, investigate, and resolve security alerts from EDR, SIEM, cloud security (CNAPP), and identity/SaaS sources, ensuring accurate severity classification and timely response.
• Hands-on incident response activities: scoping, containment, evidence collection (including remote forensics/live response), remediation, and documentation.
• Build, maintain, and optimize SOAR playbooks and automation workflows to streamline alert handling and response actions.
• Perform investigation and threat hunting across endpoint telemetry, cloud logs, and identity provider audit logs.
• Contribute to detection engineering: tune existing rules, reduce false positives, and develop new detections based on emerging threats and incident learnings.
• Produce clear, structured incident reports and maintain investigation documentation to internal standards.
• Collaborate with engineering and IT teams during investigations and remediation, communicating findings and required actions effectively.
• Support the continuous improvement of response procedures, playbooks, and severity/SLA criteria.

Must have:

• Hands-on experience in a SOC or incident response role performing alert triage, investigation, and incident handling. Knowledge of the incident response lifecycle.
• Experience with EDR platforms (e.g., CrowdStrike Falcon, SentinelOne, Cortex XDR, Microsoft Defender) for detection analysis, process tree investigation, and live response.
• Experience working with a SIEM for log analysis and investigation, including writing and adapting queries.
• Practical experience building or maintaining SOAR playbooks and security automation workflows.
• Solid understanding of common attack techniques (MITRE ATT&CK), malware delivery chains, phishing, and account takeover scenarios.
• Familiarity with cloud environments and SaaS/identity log sources.
• Strong analytical and problem-solving skills, with rigor in documenting findings.
• 3+ years of experience in security operations, incident response, or similar hands-on cybersecurity roles.
• Fluent in English (written and spoken).
• Good communication skills.

It would be a plus if you have:

• Bachelor's or Master's Degree in Computer Science, Information Security, or another similar relevant degree (or equivalent experience in a technical security role).
• Experience with Cloud service providers (e.g., AWS, GCP, etc) and their security components.
• Scripting skills (Python, Bash, or similar) for automation and log parsing.
• Experience with digital forensics.
• Familiarity with threat intelligence platforms and IOC management.
• Certifications such as BTL1/BTL2, GCIH, HTB CDSA, CySA+, CrowdStrike certifications (CCFA/CCFR), cloud security certifications (e.g., AWS Security Specialty, Google Professional Cloud Security Engineer) or equivalent hands-on blue team certifications.

• "Relación de dependencia" contract.
• Opportunity to have a real impact in a high-growth global category leader
• 40% discount on all Fever events and experiences
• OSDE 410 as medical insurance
• Home office friendly anywhere in Argentina
• Responsibility from day one, and professional and personal growth
• Great work environment with a young, international team of talented people to work with!
• English Lessons
• Gympass
• Attractive compensation package consisting of base salary and the potential to earn a significant bonus for top performance.