Security Operations Responder

About the role

Software AG is looking for a detail‑oriented Security Operations Responder to join its São Paulo team. The role supports external cybersecurity incident response and acts as the main liaison between the Security Operations Center and internal IT teams, handling rapid containment, remediation and initial forensic actions during active security events.

Key responsibilities

• Serve as the first line of defense, initiating incident response steps and isolating compromised endpoints.
• Execute emergency containment actions, revoke tokens, reset accounts and support identity‑protection activities.
• Perform initial forensic reviews, accurately document incident details and maintain incident records.
• Support compliance with the Americas zero‑trust security baseline for laptops and endpoints.
• Coordinate response activities with regional and global security stakeholders.
• Track remediation tasks and ensure follow‑up actions are completed.

Required profile

• 5+ years of experience in IT or cybersecurity operations.
• Strong hands‑on experience with Microsoft Defender for Endpoint and Microsoft Sentinel.
• Solid understanding of incident response processes and the Cyber Kill Chain.
• Ability to stay focused and make sound decisions under high‑pressure situations.
• Advanced written and spoken English proficiency.
• Remote work may be considered for exceptional candidates based elsewhere in Brazil.

Required skills

• Microsoft Defender for Endpoint
• Microsoft Sentinel
• Incident response
• Cyber Kill Chain
• Endpoint security
• Identity protection
• Access management