Location: Remote (anywhere in Mexico)

Schedule: Rotation may occur quarterly.

Language: Advanced/fluent English required.

About the role

Join a large, established Digital Security team operating 24x7 cybersecurity monitoring and incident response. This is a hands-on operational role: you will own incidents end to end — detect, investigate, contain, eradicate and remediate — not simply triage and escalate. You will report to a local leader in Mexico and work in close collaboration with technology teams in the United States. These are additive positions on an existing team. You will not be working alone.

What you'll do

- Apply your expertise in IT security, security operations and incident response to maintain robust 24x7 cybersecurity operations, ensuring swift and effective handling of incidents and ongoing protection of organizational assets.
- Own and coordinate incident management, threat hunting, forensic analysis and remediation efforts to mitigate threats. Conduct regular assessments to identify vulnerabilities and insecure configurations, and review security change requests to ensure robust protective measures.
- Configure and monitor security tooling, including alerts, correlation rules and reporting mechanisms. Implement automation and orchestration to improve the efficiency of security monitoring and response, working toward a unified "single pane of glass" solution.
- Leverage threat intelligence to monitor threats and detect vulnerabilities, assess event severity, define mitigation approaches, and feed lessons learned back into stronger preventive and detective controls.
- Stay current on security practices and technologies,



mentor teammates through knowledge-sharing sessions, and build strong relationships with internal technology groups to ensure strategic alignment.
- Develop work products and support small projects, threat assessments and incident investigations, managing deadlines and expectations and contributing to staffing decisions.

What we're looking for
- 3+ years of hands-on experience in cybersecurity operations , with demonstrable ownership of incidents through containment, eradication and remediation — including implementing processes and playbooks for cybersecurity monitoring and incident response.
- ServiceNow — the team receives and manages vulnerabilities, risks and alerts through this platform, so working knowledge is essential.
- EDR platforms — hands-on experience with Microsoft Defender for Endpoint and/or CrowdStrike Falcon and/or Zscaler .
- SIEM experience — you have worked daily inside a SIEM platform and can configure alerts, correlation rules and reporting mechanisms, not only monitor dashboards built by others.
- Advanced English , written and verbal. You will communicate risk and technical information, and host meetings, in a matrixed international environment. Clear communication is itself a security control.
- Strong analytical, collaboration and presentation skills.

Nice to have
- Experience with SIEM platforms and writing correlation rules and detection use cases.
- Scripting or automation experience, preferably Python or shell scripting .
- Security orchestration and automation tooling, such as Palo Alto Cortex XSOAR . This is genuinely optional — we do not expect it.
- Certifications such as CISSP, CCSP, CCSK, GSEC, GCIH, GCFE, GCFA, SC-200, CEH or AZ-900.

📌 Security Risk Management (México)
🏢 LaPieza
📍 México