Cybersecurity Incident Response & DFIR Expert

About the role

Holcim’s Americas Digital Center is looking for a Cybersecurity Incident Response & DFIR Expert to lead high‑severity incident response and digital forensics activities across the Americas time zone. The role blends hands‑on technical mitigation of critical threats with the design of proactive cyber drills and automation of response playbooks.

Key responsibilities

• Coordinate and lead containment of critical cyber incidents such as ransomware attacks and advanced intrusions, directing technical teams under pressure.
• Conduct deep‑dive digital forensics investigations, analysing logs, system memory, network traffic and endpoints to determine root cause and attack scope.
• Produce comprehensive technical reports, document lessons learned, and generate Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs).
• Design and execute cyber‑attack simulations (cyber drills) and develop hardened incident response playbooks.
• Translate complex technical findings into executive‑level briefings for crisis committees and senior leadership.

Required profile

• Proven expertise in incident response and digital forensics within a corporate environment.
• Ability to lead multidisciplinary technical teams during high‑pressure security events.
• Strong communication skills to convey technical details to executive audiences.

Required skills

• Incident response
• Digital forensics
• Ransomware analysis
• Threat intelligence
• Indicators of Compromise (IOCs) generation
• Tactics, Techniques, and Procedures (TTPs) documentation