Senior Digital Forensics and Incident Response Consultant

Forensic Focus Limited; Ettlingen; Hybrid; EUR 55.000 - 85.000; Vollzeit

Zusammenfassung

Forensic Focus Limited seeks an experienced DFIR consultant to investigate security incidents across enterprise environments, performing host and network forensics, malware reverse engineering, and root cause analysis. You will draft incident response playbooks, run tabletop exercises, and deliver reports to both technical and management audiences.

The role requires a degree in computer science or equivalent, fluency in German and English, and familiarity with MITRE ATT&CK and NIST frameworks.

Qualifikationen

• Degree in computer science or equivalent.
• Strong knowledge of Windows, macOS, Unix/Linux and mobile forensics.
• SANS certifications such as GCFE, GCFA, GNFA or GREM are advantageous.
• Familiarity with MITRE ATT&CK and NIST frameworks is beneficial.
• Fluent German and English required.

Aufgaben

• Investigate security incidents across enterprise networks, servers and endpoints.
• Perform host-based and network forensic analysis, including live and dead-box examination.
• Include malware reverse engineering and root cause analysis in investigations.
• Draft IR playbooks and run tabletop exercises for clients.
• Produce reports for technical and management audiences; travel and on-call duties may be involved.

Kenntnisse

Windows

macOS

Unix/Linux

Mobile forensics

Ausbildung

Degree in computer science or equivalent

SANS GCFE/GCFA/GNFA/GREM certifications (advantageous)

Jobbeschreibung

The Role

The consultant investigates security incidents across enterprise networks, servers and endpoints, performing host-based and network forensic analysis, including live and dead-box examination. Responsibilities include malware reverse engineering, root cause analysis, drafting IR playbooks, running tabletop exercises, and producing reports for both technical and management audiences.

Skills & Experience

Candidates should hold a degree in computer science or equivalent and demonstrate strong knowledge of Windows, macOS, Unix/Linux and mobile forensics. SANS certifications such as GCFE, GCFA, GNFA or GREM are advantageous. Familiarity with MITRE ATT&CK and NIST frameworks, plus fluent German and English, is required.

Who It Suits

This role suits an experienced DFIR professional who thrives in a client-facing consulting environment, is comfortable with on-call duties and travel, and wants to operate across a broad range of incident types — from initial triage through to proactive readiness and remediation engagements.