Incident Response Expert

Forensic Focus Limited; Düsseldorf; Hybrid; EUR 81.000 - 115.000; Vollzeit

Zusammenfassung

Forensic Focus Limited seeks an experienced Incident Response Expert for a remote, high-impact contractual role in Germany. You will design an incident response operating model, develop playbooks, and drive exercises to test readiness and reduce residual risk.

You will work with senior stakeholders and technical teams, bringing eight+ years of IR or security operations experience, and leveraging Microsoft Security stack skills across Azure and Entra ID. Fluency in German and English is required.

Qualifikationen

• Eight+ years in incident response, cyber defence or security operations.
• Hands-on experience handling ransomware, endpoint intrusions and cloud compromise.
• Strong knowledge of Microsoft Security stack, Azure and Entra ID.
• Certifications such as GCIH, GCFA, GNFA, CISSP, SC-200 or AZ-500 are advantageous.

Aufgaben

• Design and implement a comprehensive incident response operating model.
• Develop playbooks and SOPs for ransomware, identity compromise and cloud control plane abuse.
• Conduct technical gap analyses, run IR exercises, and produce management dashboards on readiness gaps and residual risks.

Kenntnisse

Incident response

Cyber defence

Security operations

Ransomware

Endpoint intrusions

Cloud compromise

Microsoft Security stack

Azure

Entra ID

German language

English language

Jobbeschreibung

# Incident Response Expert*Michael Page***Düsseldorf, North Rhine-Westphalia**Remote · Senior · Full-time### The RoleThis contract position centres on designing and implementing a comprehensive incident response operating model. Day-to-day work includes developing playbooks and SOPs for scenarios such as ransomware, identity compromise and cloud control plane abuse, conducting technical gap analyses, running IR exercises, and producing management dashboards on readiness gaps and residual risks.### Skills & ExperienceCandidates need at least eight years in incident response, cyber defence or security operations, with hands-on experience handling ransomware, endpoint intrusions and cloud compromise. Strong knowledge of the Microsoft Security stack, Azure and Entra ID is essential. Certifications such as GCIH, GCFA, GNFA, CISSP, SC-200 or AZ-500 are advantageous.### Who It SuitsThis role suits a seasoned IR practitioner comfortable advising both technical teams and senior stakeholders during critical incidents. Fluency in German and English is required. The fully remote engagement runs until end of Q1 2027, making it ideal for an experienced contractor seeking a structured, high-impact project assignment.Typical advertised salary forIncident Response roles in Germany:**€81,000–€115,000**(median €88,000 — from15 recent listings analysed by Forensic Focus).Compare Incident Response salaries in Germany →Certifications mentioned:GCFA · GNFA · GCIH · CISSP — find training for these on theDFIR Training Finder.Learn More/Apply