Cyber Incident Responder

About the role

The Information Systems Agency of Armenia (ISAA) runs AM-CERT, which investigates and responds to cybersecurity incidents, coordinates response with affected organisations and helps improve national cyber resilience through lessons learned, playbooks and exercises. The role may involve on-call or shift-based duties depending on operational needs.

Key responsibilities

• Perform incident triage: validate alerts, assess severity and impact, scope affected assets and recommend immediate containment.
• Investigate incidents across endpoint, network, cloud and application environments using logs, telemetry and forensic artifacts.
• Coordinate containment, eradication and recovery with system owners, service providers and other stakeholders, including on-site support when needed.
• Collect, preserve and document evidence forensically soundly and maintain chain of custody where applicable.
• Produce incident reports, after-action reviews and recommendations for remediation and risk reduction.
• Develop, maintain and test incident response playbooks, SOPs and runbooks for common incident types such as ransomware, DDoS and data breaches.
• Support threat hunting, vulnerability and malware analysis, and publish guidance or advisories when appropriate.
• Take part in national cyber exercises, tabletop simulations and training, and contribute to mentoring and knowledge sharing.

Required profile

• 3+ years of hands-on experience in incident response, SOC operations, DFIR or cyber roles.
• Strong understanding of incident response methodologies across the full lifecycle.
• Preferred: CERT/CSIRT or critical infrastructure experience, and experience with forensic triage, malware analysis or reverse engineering.
• Preferred: familiarity with threat actor TTPs and frameworks such as MITRE ATT&CK, and experience writing public guidance and using information-sharing practices like the Traffic Light Protocol.
• Professional working proficiency in Armenian and English.

Required skills

• Solid knowledge of networking and Windows and Linux, with log and network traffic analysis.
• Experience with SIEM, EDR, network monitoring and forensic tools.
• Strong documentation and reporting skills, and clear communication under pressure.
• Certifications such as GIAC (GCIH, GCIA, GCFA/GCFE, GMON), CompTIA CySA+ or Security+, CISSP, or vendor certifications for SOC/EDR/SIEM tools are an advantage.

To apply, send your CV by email to the agency's HR department, mentioning the position name in the subject line.