Computer Security Incident Response Team
Description
CSIRT is the operational defense unit responsible for handling active security incidents across the organization. It focuses on detecting, analyzing, responding to, and containing attacks in real time.
CSIRT operates primarily in the “Am I Under Attack / Am I Compromised” (AMI3A) phases, ensuring threats are identified, investigated, and mitigated quickly to reduce impact.
Responsibilities
- Monitor and triage security alerts and incidents
- Perform incident analysis (RA / FP / FN classification)
- Lead investigation using logs, telemetry, and forensic methods (FIP)
- Execute containment, mitigation, and recovery actions
- Coordinate cross-team response (SOC, DevOps, IT, management)
- Maintain incident documentation (war logs, reports)
- Validate effectiveness of mitigation (Assure phase)
- Improve detection and response playbooks
Job Description
Strong communication skills for technical and non-technical stakeholders
Hands-on incident responder with strong analytical skills
Experience with security tools (SIEM, WAF, EDR, logs analysis)
Ability to investigate attacks across application, network, and infrastructure layers
Strong understanding of attack techniques (web exploits, brute force, DDoS, bots)
Ability to operate under pressure and make real-time decisions
Familiarity with incident response frameworks and methodologies
SIRT Positioning:
- CSIRT → Handles attacks (Execution layer)
- PSIRT → Handles vulnerabilities (Prevention layer)
- TA-SIRT → Measures & improves effectiveness (Strategy layer)
The complete defensive model:
- PSIRT reduces exposure
- CSIRT handles active threats
- TA-SIRT ensures it all actually works