Incident Responder Lead

Join our team as an Incident Responder Lead, where you will lead incidents from initial assessment to closure, coordinate investigation and recovery, guide clients through difficult decisions, oversee safe restoration, own the final report, coach responders, and lead the adoption of cutting-edge AI tools across incident response. Enjoy flexible work options, competitive compensation, financial support, continuous learning, team and social events, and a challenging and supportive culture.

Responsibilities

• Lead incidents from initial assessment to closure, coordinating investigation and recovery efforts.
• Guide clients through difficult decisions, explaining findings, recovery options, and tradeoffs in plain language.
• Oversee safe restoration, reviewing recovery plans, challenging assumptions, and ensuring documentation.
• Professional working proficiency in German and English to lead client and international partner discussions, explain technical decisions and provide written updates
• Experience managing an incident, major outage or recovery project: defining scope, coordinating specialists and providers, tracking actions and dependencies, and escalating delivery risks
• Technical knowledge of backup and restore workflows and system dependencies, sufficient to review specialist recommendations and explain tradeoffs to clients
• Experience with threat hunting and integrating threat intelligence into investigations to prioritise hypotheses, assess indicators of compromise and guide response decisions

Requirements

• Practical experience applying AI tools to technical work, such as agentic workflows or information extraction, and assessing their reliability. Bring curiosity, openness to feedback and the ability to guide adoption
• Experience using SIEM, EDR and forensic tools, such as Windows Defender for Business, Splunk, CrowdStrike, Velociraptor, X-Ways, KAPE, Hayabusa, SOF-ELK or OpenRelik. These are examples; experience with comparable tools is equally relevant
• Typically 3+ years of relevant experience in incident response, recovery, infrastructure or technical project delivery, including coordinating complex recovery work
• Clear communication, sound judgement about when to seek specialist help, and the ability to keep clients and colleagues aligned under pressure
• Strong understanding of practical restoration, gained through delivering or supervising recovery in SMEs or comparable environments. You can assess plans, challenge assumptions and judge whether recovery checks are sufficient
• Experience writing incident or root-cause reports that explain evidence, findings, limitations and remediation clearly. You can take responsibility for the final report from the outset