Ines Carvalho
Porto · ines.carvalho@example.com
4 November 2026
Mr Rui Almeida
Head of Security Operations
Cascais Payments Group
Subject: Application for Security Analyst
Dear Mr Almeida,
Our mean time to contain an incident fell from six hours to 90 minutes after I wrote playbooks for the five most common alert types. That is the work I want to keep doing as a Security Analyst at Cascais Payments Group.
At Douro Financial Services I triage about 200 alerts a day in Microsoft Sentinel and escalate confirmed incidents to the response lead. Every closure gets a written report within two days, covering the timeline, the cause and the fixes. Each quarter I review user access in Microsoft Entra ID and remove accounts nobody uses, which closed 180 stale accounts in a year. At a payments firm, every unused login is one more door an auditor will ask about.
Cascais bringing its monitoring in-house is the reason this advert stood out. A new in-house team needs playbooks before it needs more alerts, and I have written that first set once already. It also suits my background: I moved into security from IT support at Foz Atlantic Insurance Group, where I set up multi-factor authentication for 400 users, so I know how a control lands with the people who live with it. That shapes how I raise staff awareness of phishing. I run simulations for 1,500 staff twice a year, and the click rate has fallen from 14% to 6%.
The handover from an outside provider is where alerts tend to get lost, so in an interview I want to ask what yours will pass on, and to show you how I decide which alert type gets the next playbook.
Kind regards,
Ines Carvalho