Incident Responder Lead (m/w/d)

Baobab Insurance GmbH; Berlin; On-site; EUR 90,000 - 120,000; Full time

Benefits offered by this job

Flexible Working

Competitive salary

VSOP options

Growth opportunities

Job summary

Baobab Risk Solutions seeks an experienced Incident Response Lead to guide end-to-end incident handling, from detection through recovery. You will coordinate responders and align with client IT providers, driving clear, actionable plans across Windows, AD, M365 and backups.

You will communicate findings in plain language to business and technical stakeholders, supervise restoration, mentor junior responders, and introduce cutting-edge AI tools to improve investigation and automation workflows.

Qualifications

• Lead incidents from initial assessment to closure.
• Coordinate investigation and recovery with responders and client IT providers.
• Work across client infrastructure including Windows, Active Directory, Microsoft 365, virtualization and backups.
• Explain findings and recovery options in plain language.
• Oversee safe restoration and review recovery plans.
• Own the final report with clear conclusions and evidence.
• Coach responders and turn lessons into runbooks.
• Lead adoption of AI tools across incident response.

Responsibilities

• Lead incidents from initial assessment to closure.
• Coordinate investigation and recovery with responders and client IT providers.
• Explain findings and recovery options in plain language.
• Oversee safe restoration and review recovery plans.

Skills

Incident response

Leadership

Cross-functional coordination

Stakeholder communication

Problem solving

Tools

Windows

Active Directory

Microsoft 365

Virtualization

Backups

Job description

Welcome to Baobab Risk Solutions -- Your Partner for the Cyber Security of Tomorrow!

The digital world is growing -- and with it, the threat of cyber attacks. Every successful attack not only jeopardises businesses but also undermines trust in our connected society. At Baobab Risk Solutions, we are committed to making the digital world safer -- proactively, sustainably, and with cutting-edge technology. Our mission: to protect companies from cyber threats before they arise, contributing to a more secure digital future.

Shape the digital security of tomorrow with us. Join a team that doesn't just watch but actively protects. Your ideas and commitment can make all the difference. If that's not enough, here's more:

• Flexible Working: With your MacBook, you can work from home two days per week and work in our modern office in Berlin the remaining days.
• Attractive Compensation: Competitive salary and VSOP options.
• Growth & Career: Grow with us -- in a dynamic company with clear advancement opportunities.
• and many more benefits.

Baobab Risk Solutions -- Growing together. Making the digital world safer, together.

Your Mission

• Lead incidents from initial assessment to closure. Establish scope, agree priorities, assign responsibilities and adjust the response as new evidence emerges.
• Coordinate investigation and recovery. Bring responders, recovery specialists and client IT providers together around a clear plan, managing dependencies and resolving blockers.
• Work across client infrastructure, including Windows, Active Directory, Microsoft 365, virtualization and backups. Bring in specialists where needed; expertise in every platform is not expected.
• Guide clients through difficult decisions. Explain findings, recovery options and tradeoffs in plain language, keeping technical teams and business stakeholders informed.
• Oversee safe restoration. Review recovery plans, challenge assumptions about backups and system dependencies, and ensure the checks supporting a return to service are documented.
• Own the final report. Review and approve incident reports, ensuring conclusions, limitations and recommendations are clear and supported by evidence.
• Coach responders, review their work and turn lessons learned into better recovery runbooks.
• Lead the adoption of cutting-edge AI tools across incident response. Turn promising approaches into practical investigation, recovery and automation workflows, coach the team in their use, and validate results while protecting incident data.