Incident Responder (German speaking)

Baobab; Berlin; Hybrid; EUR 75,000 - 105,000; Full time

Benefits offered by this job

Flexible work options

28 vacation days

Competitive compensation

Financial support (Germany ticket)

Udemy Learning access

Team events

Supportive culture

Job summary

Baobab is seeking an experienced security incident responder to lead containment, forensic investigations and recovery efforts for ransomware, BEC and related threats. You will preserve evidence, analyze logs and collaborate with client teams across Windows, AD and M365 environments.

The role emphasizes applying AI tools for investigations, improving playbooks, and delivering precise communication with stakeholders in English and German. Hybrid work options are available across Germany.

Qualifications

• Proficient in German and English for client discussions and coordination.

Responsibilities

• Execute containment and forensic investigation of ransomware, BEC and other incidents; preserve evidence and analyse logs.
• Support systems restoration after cyber incidents: assess backups, rebuild servers and endpoints.
• Collaborate with client IT teams and MSPs across Windows, Active Directory, Microsoft 365, virtualization and backup environments.
• Document technical work and communicate progress, uncertainties and blockers; escalate risks.
• Apply cutting-edge AI tools to investigations, recovery and automation, validate results and shape adoption while protecting incident data.
• Improve recovery checklists, scripts and playbooks by sharing lessons from casework.

Skills

Incident response

IT support

Backup & restore

Threat hunting

English (fluent)

German (fluent)

Tools

SIEM

EDR

Windows Defender for Business

Splunk

CrowdStrike

Velociraptor

X-Ways

KAPE

Hayabusa

SOF-ELK

OpenRelik

Job description

• Execute containment and forensic investigation of ransomware, business email compromise and other incidents: preserve evidence, analyse host and identity logs, and develop findings with specialist guidance
• Support systems restoration after cyber incidents: assess backups, rebuild servers and endpoints, resolve dependencies and validate services before returning them to use
• Work with client IT teams and managed service providers across Windows, Active Directory, Microsoft 365, virtualisation and backup environments
• Document technical work and communicate progress, uncertainties and blockers, escalating risks to the lead
• Put cutting-edge AI tools to work in investigations, recovery and automation. Experiment with new approaches, validate results and help shape how the team adopts them, while protecting incident data
• Improve recovery checklists, scripts and playbooks by sharing lessons from casework

Benefits

• Flexible work options - you work from home or our offices in Berlin and Cologne
• 28 Vacation Days - plus Christmas Eve & New Year’s Eve
• Competitive Compensation - Attractive salary & equity options
• Financial Support - subsidized Germany ticket and Wellpass membership, company pension support and corporate benefit access
• Continuous Learning - Support for your professional growth and development, both internally and through access to the Udemy Business platform
• Team & Social Events - Regular team events to get the entire team together from across Germany
• Challenging & Supportive Culture - Work with motivated colleagues in an environment where you can grow, achieve, and enjoy the journey

Basic experience documenting technical work in tickets, change logs or recovery notesProfessional working proficiency in German and English for client discussions, written updates and coordination with international response partnersOpenness to coaching and feedback, and motivation to develop your security and investigation skills2+ years of hands-on experience in IT support, systems administration, recovery or incident responsePractical experience using AI tools for technical tasks, such as information extraction, log analysis or agentic workflowsExperience using SIEM, EDR and forensic tools, such as Windows Defender for Business, Splunk, CrowdStrike, Velociraptor, X-Ways, KAPE, Hayabusa, SOF-ELK or OpenRelik. (These are examples; experience with comparable tools is equally relevant.)English - business fluentGerman - business fluentStrong practical restoration experience, ideally with SMEs or small IT teamsHands-on troubleshooting and backup or restore knowledge, with willingness to learn unfamiliar technologiesFamiliarity with threat hunting and using threat intelligence to guide investigations, prioritize suspicious activity and assess indicators of compromise