Senior Incident Response Lead

CSIS Security Group; Denmark; Hybrid; DKK 900,000 - 1,300,000; Full time

Benefits offered by this job

Flexible work from home arrangements

Competitive salary and benefits

5 weeks holiday + 5 extra days

Health insurance and pension

Lunches, snacks, and beverages in the/

Social events and company activities

Paid mobile and home internet

Job summary

CSIS Security Group in Denmark seeks an experienced Incident Response Lead to drive major client engagements across on‑prem, cloud and hybrid environments. You will guide junior responders, communicate clearly with executives, and strengthen clients’ detection and response capabilities.

The role involves cross‑team collaboration with MDR, intelligence and consulting, plus developing IR playbooks, tooling and publications. Remote flexibility is available in a Danish context.

Qualifications

• Hands-on incident response experience in consultancy or CSIRT environments.
• Proven track record leading multi-client investigations.
• Deep knowledge of Windows, Linux, and Active Directory security.
• Strong knowledge of network protocols and security.
• Experience with SIEM/EDR tools and threat analysis.
• Familiarity with evidence handling and forensic reporting.
• Understanding of MITRE ATT&CK and cloud investigations.

Responsibilities

• Lead major incident response engagements for multiple clients.
• Guide junior responders and coordinate with client teams, management, and legal contacts.
• Develop incident timelines, root-cause analyses and executive summaries.
• Contribute to IR methodologies, tooling, and playbooks.
• Mentor teammates and support IR training and tabletop exercises.

Skills

Incident response

Multi-client leadership

Windows security

Linux security

Cloud forensics

MITRE ATT&CK

SOC/IR tooling

Python or PowerShell

Tools

Sentinel/Defender

CrowdStrike

Azure

AWS

GCP

Job description

CSIS Security Group in Denmark seeks an experienced Incident Response Lead to drive major client engagements across on‑prem, cloud and hybrid environments. You will guide junior responders, communicate clearly with executives, and strengthen clients’ detection and response capabilities.

The role involves cross‑team collaboration with MDR, intelligence and consulting, plus developing IR playbooks, tooling and publications. Remote flexibility is available in a Danish context.