Incident Responder Lead

Baobab; Berlin; Hybride; EUR 70 000 - 110 000; Plein temps

Avantages offerts par ce poste

Hybrid work options

28 vacation days

Competitive compensation

Germany ticket subsidy

Wellpass membership

Company pension

Udemy access

Team events

Résumé du poste

Baobab in Berlin sucht eine erfahrene Lead-Incident-Response-Führungskraft. Sie steuern Vorfe4lle von der ersten Bewertung bis zum Abschluss, koordinieren Untersuchungen und Abhilfemaßnahmen und arbeiten eng mit Clients, IT-Providern und Sicherheitsteams zusammen.

Sie bringen mehrje4hrige Erfahrung im Incident Management, der Wiederherstellung von Diensten und dem Schreiben von Berichten mit. Gute Deutsch- und Englischkenntnisse sowie die Bereitschaft, KI-Tools in Praxisworkflows zu

Qualifications

• Erfahrung im Vorfallmanagement, Recovery und Infrastruktur-Delivery.
• Nachweisliche Fähigkeit, Restoration praktisch zu planen und zu überprüfen.
• Starke Kommunikationsfähigkeiten auf Deutsch und Englisch.

Responsabilités

• Vorfälle von Erstbewertung bis Abschluss leiten.
• Untersuchung und Wiederherstellung koordinieren; Stakeholder einbeziehen.
• Auf sichere Wiederaufnahme achten; Backups und Abhängigkeiten prüfen.
• Endbericht prüfen, Schlussfolgerungen und Empfehlungen darlegen.
• Responders coachen und Learnings in Runbooks übertragen.
• KI-Tools in Untersuchungen und Abteilungsworkflows einführen.

Connaissances

Incident response

Recovery management

Infrastructure delivery

Threat hunting

German language

English language

Stakeholder communication

Team leadership

Outils

Splunk

CrowdStrike

Velociraptor

X-Ways

KAPE

SOF-ELK

OpenRelik

Windows Defender for Business

Description du poste

• Lead incidents from initial assessment to closure. Establish scope, agree priorities, assign responsibilities and adjust the response as new evidence emerges
• Coordinate investigation and recovery. Bring responders, recovery specialists and client IT providers together around a clear plan, managing dependencies and resolving blockers
• Work across client infrastructure, including Windows, Active Directory, Microsoft 365, virtualization and backups. Bring in specialists where needed; expertise in every platform is not expected
• Guide clients through difficult decisions. Explain findings, recovery options and tradeoffs in plain language, keeping technical teams and business stakeholders informed
• Oversee safe restoration. Review recovery plans, challenge assumptions about backups and system dependencies, and ensure the checks supporting a return to service are documented
• Own the final report. Review and approve incident reports, ensuring conclusions, limitations and recommendations are clear and supported by evidence
• Coach responders, review their work and turn lessons learned into better recovery runbooks
• Lead the adoption of cutting-edge AI tools across incident response. Turn promising approaches into practical investigation, recovery and automation workflows, coach the team in their use, and validate results while protecting incident data

Benefits

• Flexible work options - you work from home or our offices in Berlin and Cologne
• 28 Vacation Days - plus Christmas Eve & New Year’s Eve
• Competitive Compensation - Attractive salary & equity options
• Financial Support - subsidized Germany ticket and Wellpass membership, company pension support and corporate benefit access
• Continuous Learning - Support for your professional growth and development, both internally and through access to the Udemy Business platform
• Team & Social Events - Regular team events to get the entire team together from across Germany
• Challenging & Supportive Culture - Work with motivated colleagues in an environment where you can grow, achieve, and enjoy the journey

Practical experience applying AI tools to technical work, such as agentic workflows or information extraction, and assessing their reliability. Bring curiosity, openness to feedback and the ability to guide adoptionExperience using SIEM, EDR and forensic tools, such as Windows Defender for Business, Splunk, CrowdStrike, Velociraptor, X-Ways, KAPE, Hayabusa, SOF-ELK or OpenRelik. These are examples; experience with comparable tools is equally relevantExperience managing an incident, major outage or recovery project: defining scope, coordinating specialists and providers, tracking actions and dependencies, and escalating delivery risksExperience writing incident or root-cause reports that explain evidence, findings, limitations and remediation clearly. You can take responsibility for the final report from the outsetStrong understanding of practical restoration, gained through delivering or supervising recovery in SMEs or comparable environments. You can assess plans, challenge assumptions and judge whether recovery checks are sufficientTechnical knowledge of backup and restore workflows and system dependencies, sufficient to review specialist recommendations and explain tradeoffs to clientsClear communication, sound judgement about when to seek specialist help, and the ability to keep clients and colleagues aligned under pressureProfessional working proficiency in German and English to lead client and international partner discussions, explain technical decisions and provide written updatesTypically 3+ years of relevant experience in incident response, recovery, infrastructure or technical project delivery, including coordinating complex recovery workGerman - business fluentEnglish - business fluentExperience with threat hunting and integrating threat intelligence into investigations to prioritise hypotheses, assess indicators of compromise and guide response decisions