We are your Energy Technology Partner. We electrify, automate, and digitalize every industry, business, and home, driving efficiency and sustainability for all. At Schneider Electric, our values – IMPACT (Inclusion, Mastery, Purpose, Action, Curiosity, Teamwork) – are the foundation of everything we do. Becoming an Impact Maker means turning sustainability ambitions into actions at the intersection of automation, electrification, and digitization. Are you ready to lead the digital transformation to create a more sustainable world?ð3If you are up to challenge your creativity and make an impact, we are excited to welcome you Schneider Digital is the digital department of Schneider Electric, leading the digital transformation in the company by giving support globally to our internal teams and our clients. Schneider Digital consists of 6 Digital Hubs worldwide which are strategically located to ensure a 24/7 support across the company (France, China, India, USA, Mexico and Spain). Our Digital Hub in Barcelona is formed by +450 employees working in strategic projects and different roles such as Data, Cybersecurity, ERP, Cloud, Infrastructures, IT Project Management or Digital Marketing.
We are looking for a Cybersecurity Incident Response Engineer to join the Enterprise IT Infrastructure Security team in Barcelona. The role focuses on cybersecurity incident response and supports the consistent handling of incidents impacting Enterprise IT.The successful candidate will independently manage security incidents within the assigned regional scope, following established incident response processes and playbooks. The role requires sound technical analysis, disciplined case management, effective coordination with operational teams, and timely escalation when an incident exceeds the assigned scope or severity.




Role MissionExecute the end-to-end incident response lifecycle for assigned cybersecurity incidents within one region.
Validate alerts, determine incident scope and impact, coordinate containment and recovery actions, and document conclusions and evidence.
Apply approved playbooks and procedures consistently, adapting case tasks when required while escalating high-priority, general, or highly complex incidents to senior responders or incident owners.
Maintain clear communication with technical teams, regional cybersecurity stakeholders, and affected business contacts throughout the investigation.
What will you do? Key ResponsibilitiesIncident Triage and InvestigationReview security alerts and reported events to determine whether they represent a cybersecurity incident.
Assess severity, affected assets, users, business scope, and potential impact using established classification criteria.
Collect and analyze relevant evidence, including SIEM events, endpoint telemetry, identity and sign-in data, email artefacts, network logs, cloud activity, and indicators of compromise.
Develop and document an investigation timeline, working hypotheses, findings, and technical conclusions.
Escalate promptly when evidence indicates high impact, cross-regional scope, legal or privacy implications, or the need for specialist forensic analysis.
Containment,



Eradication and RecoveryCoordinate containment actions with SOC, endpoint, identity, messaging, network, cloud, infrastructure, and application teams. Use approved playbooks and response procedures to reduce exposure while preserving relevant evidence.
Track assigned remediation and recovery actions through completion and validate that agreed technical measures have been implemented.
Case Management and CommunicationMaintain accurate and timely case records, including actions taken, evidence reviewed, decisions, owners, and status updates.
Provide clear technical summaries for both technical and non-technical stakeholders in English.
Coordinate with regional Digital Risk Leaders, CISOs, SOC, Cyber Defense, Infrastructure, Identity, Forensics, Threat Intelligence, Privacy, and other teams as required by the case.
Participate in handovers and operational reviews to support continuity of response across time zones.
Contribute factual input to post-incident reviews and lessons learned. Ownership of process redesign or strategic improvement initiatives is not a core expectation of this role.
Detection and Technical EnablementUse SIEM, EDR, identity, network, cloud, email security, and case-management tools to investigate incidents.
Create or adapt basic hunting queries and scripts to collect, normalize, correlate, or summarize investigative data.
Use approved automation and AI-assisted capabilities to improve the speed and consistency of analysis and reporting, under established governance and review controls.
Share recurring operational observations with senior responders and detection or engineering teams for further assessment.
What qualifications will make you successful?
Experience and Edu

📌 Cyber and Security Engineer (Barcelona)
🏢 Schneider Electric
📍 Barcelona