Senior Incident Response & Digital Forensics Consultant

Nviso; Brussel Hoofdstad; Sur place; EUR 80 000 - 100 000; Plein temps

Résumé du poste

A cybersecurity services provider in Brussels is looking for a Senior Incident Response Consultant to join their skilled team. The role involves supporting the incident response team in a variety of cyber incidents, leading forensic investigations, and presenting findings to stakeholders. The ideal candidate has over three years of incident response experience and excels in digital forensics. This position offers a competitive remuneration package, including personalized coaching and flexible work options with exciting team-building events.

Prestations

Training budget of €10,000

Flexible working hours

Additional leave days

Personal coaching

Qualifications

• 3+ years of hands-on experience in incident response.
• Strong knowledge of digital forensics on multiple OS.
• Proficient in coordinating remediation actions.

Responsabilités

• Support the incident response team in cyber incidents.
• Perform host, network, and memory forensics.
• Lead customer calls during incidents and deliver reports.

Connaissances

Cyber intrusion analysis

Incident response

Digital forensics

Analytical skills

Communication skills

Outils

Magnet AXIOM Cyber

Volatility

Wireshark

GRR Rapid Response

Description du poste

Who are we?

It all starts with the mission: NVISO is here to protect European society from potentially devastating cyber attacks! This means we offer cyber security services to private and governmental organizations to help them better prepare for, prevent, detect and respond to cyber security incidents.

All of this is built on four fundamental values that define who we are: We are Proud, We Break Barriers, We Care and No BS!

What will you do?

As aSenior Incident ResponseConsultant, you will support the NVISO incident response team (CSIRT) in responding to a wide range of cyber incidents. In addition to incident response and forensic engagements, you will work closely with the rest of the team to build & automate incident response processes, analytical capabilities, including threat hunting. You act as Incident Lead by setting investigative questions, delegating technical analysis tasks, and steer containment and eradication strategies. You produce high-quality forensic and executive reports to present findings to technical stakeholders and executives. You occasionally peer-review case notes, artifacts, and draft reports.

Your responsibilities

• Performhost forensics(Magnet AXIOM Cyber, X-Ways, Autopsy),network forensics(Wireshark, tshark),memory forensics(Volatility, MemProcFS), andlog analysis,including cloud telemetry(Microsoft 365/Azure, AWS, Google Cloud/Workspace), in support of cyber incident investigations.
• Lead single-system forensicanalysis and contribute meaningfully to complex intrusions, including those with lateral movement, perform timeline analysis of compromised hosts and conduct live response artifact capture, volatile data collection, containment to support eradication and recovery efforts.
• Performbasic malware triageof executables and malicious scripts (static and behavioral) to inform containment and eradication strategies.
• Lead customer callsduring incidents and contribute to cyber crisis management, and deliver status reports, planning for containment, eradication and recovery efforts, and input to executive-ready communications.
• Support improvement projectsrelated to automation in digital forensics and further develop NVISO tools and incident response processes.
• Perform threat hunting engagementswithin customer environments, including technical planning, requirements definition, execution, and reporting.
• Assist in other engagements such as tabletop exercises, incident and forensic readiness assessments, and threat-intelligence-related briefings.

Requirements

• 3+ years of hands-on experience, including acting as an incident response case lead.
• Strong knowledge of cyber intrusion analysis, incident response, digital forensics on Windows/MacOS/Unix, with demonstrated expertise in memory forensics (Volatility, MemProcFS), timeline analysis (e.g., MFTECmd, KAPE, Plaso/Timesketch), and disk forensics (Magnet AXIOM Cyber, X-Ways, Autopsy).
• Proficiency with live response tooling (e.g., Velociraptor, GRR Rapid Response, EDR live response) and coordinating remediation actions.
• Up-to-date on the latest cybersecurity threats and attacker TTPs.
• Excellent analytical and problem-solving skills with an eye for detail in documentation.
• Effective communication and interpersonal skills to work collaboratively with clients and cross-functional teams.
• Ability to remain calm during crisis situations and prioritize effectively under pressure.
• Language: English (must have), German (nice to have)
• You are eligible for a NATO clearance.
• We have an On-call rotation, typically one week per month.

What do we offer

At NVISO, we care. We are committed to offering you a highly competitive remuneration package including financial and non-financial components:

• A training budget of 10.000€ and 10 days every 2 years
• Working and learning from the best people in the European cyber security industry. We have multiple SANS Instructors working at NVISO, our staff has presented at popular hacking conferences (BlackHat, BruCON, OWASP, etc) and all of our technical staff can acquire deep technical security certifications (GSE, GXPN, GREM, GCFA, OSCP, etc)
• Regular team-building and fun events with legendary off-site events once a year. The location of the next team building is one of the most closely guarded secrets at NVISO… We can however disclose that we’ve visited Lisbon, Dubai, Lapland and Malta over the past few years
• Our commitment to coach and counsel you and help you grow; each employee receives a personal coach within the team, whose role is to ensure your well-being and helps you grow in your career!
• Flexible working hours and home office possibilities (+working abroad options)
• Statutory leave plus 5 additional leave days by NVISO