Lead Incident Response Consultant – Client‑Facing, Remote

CSIS SECURITY GROUP A/S; Frederiksberg Kommune; Hybrid; DKK 900,000 - 1,300,000; Full time

Benefits offered by this job

Flexible work from home arrangements

Competitive salary & benefits package

5 weeks holiday + 5 extra days

Health Insurance & pension

Lunch options & snacks

Social activities

Phone + home internet

Job summary

CSIS SECURITY GROUP A/S in Denmark seeks an experienced incident responder to lead major IR engagements, guide clients through crises, and strengthen detection and response capabilities across on-prem, cloud, and hybrid environments.

You will work in a client-facing role with multi-team collaboration, mentor junior responders, produce clear reports for executives, and contribute to CSIS's methodologies and tooling. This is a 24/7 function with on-call and travel expectations.

Qualifications

• Hands-on incident response experience, ideally in a consultancy, MSSP, DFIR or CSIRT environment.
• Proven track record leading multi-client or multi-environment incident investigations.
• Deep knowledge of Windows, Linux, and Active Directory security.

Responsibilities

• Lead major incident response engagements for clients across varied infrastructures (on-prem, cloud, hybrid).
• Perform advanced forensic analysis (memory, disk, network, malware, cloud) and provide clear, actionable findings.
• Coordinate response activities with client teams, management, and legal/compliance contacts.

Skills

Incident response

Client-facing leadership

Windows security

Linux security

Active Directory security

Network security

SIEM & EDR tooling

MITRE ATT&CK

Cloud investigations

Forensics (memory/disk/logs)

Tools

Sentinel/Defender

CrowdStrike

Job description

CSIS SECURITY GROUP A/S in Denmark seeks an experienced incident responder to lead major IR engagements, guide clients through crises, and strengthen detection and response capabilities across on-prem, cloud, and hybrid environments.

You will work in a client-facing role with multi-team collaboration, mentor junior responders, produce clear reports for executives, and contribute to CSIS's methodologies and tooling. This is a 24/7 function with on-call and travel expectations.