Manager Digital Forensics & Incident Response (DFIR) – Cyber Security

Forensic Focus Limited; Düsseldorf; On-site; EUR 70,000 - 110,000; Full time

Job summary

Forensic Focus Limited in Germany is seeking an experienced DFIR professional to lead digital forensics investigations and incident response engagements across endpoint, network, and cloud environments, including M365, Azure, and AWS. You will analyse cyberattacks, reconstruct attack chains, perform live-response actions, and deliver clear management-facing reports throughout the incident lifecycle.

Proficiency in German and English at C1 or higher is required, as is four to seven years of

Qualifications

• 4–7 years of hands-on experience in incident response and digital forensics.
• Strong knowledge of DFIR tooling, threat analysis, and cloud forensics.
• Familiarity with modern attack vectors.
• Business-level proficiency in both German and English at C1 or above.

Responsibilities

• Lead DFIR investigations across endpoint, network, and cloud environments including M365, Azure and AWS.
• Analyse cyberattacks and reconstruct attack chains.
• Conduct live-response actions and evidence collection.
• Deliver clear management-facing reports throughout the incident lifecycle.

Skills

DFIR tools

Threat analysis

Cloud forensics

Attack vectors

German (C1)

English (C1)

Job description

The Role

This position leads digital forensic investigations and incident response engagements across endpoint, network, and cloud environments, including M365, Azure, and AWS. Day to day involves analysing cyberattacks, reconstructing attack chains, conducting live-response actions, and delivering clear reporting to management throughout the incident lifecycle.

Skills & Experience

Candidates are expected to bring four to seven years of hands-on experience in incident response and digital forensics, strong knowledge of DFIR tooling, threat analysis, and cloud forensics, alongside familiarity with modern attack vectors. Business-level proficiency in both German and English, at C1 or above, is required.

Who It Suits

This role suits an experienced DFIR professional who is comfortable leading both the technical and communicative aspects of complex investigations. Those with an agile mindset, a genuine curiosity for emerging threats, and an interest in developing methods, threat-hunting approaches, and automation will find it particularly rewarding.