Senior Security Consultant – Incident Response

CSIS SECURITY GROUP A/S; Frederiksberg; Hybrid; DKK 900,000 - 1,200,000; Full time

Benefits offered by this job

Flexible work from home arrangements

Health insurance & pension

5 weeks holiday + 5 days

Job summary

CSIS SECURITY GROUP A/S is seeking a Senior Security Consultant – Incident Response to lead major incident engagements across on-prem, cloud, and hybrid environments. You will guide clients through crises, collaborate with MDR and consulting peers, and help strengthen detection and response capabilities.

You will work with diverse environments, travel occasionally, and contribute to tooling and playbooks while mentoring junior responders and delivering clear, actionable outcomes.

Qualifications

• Hands-on incident response experience, ideally in a consultancy, MSSP, DFIR, or CSIRT environment.
• Proven track record leading multi-client or multi-environment incident investigations.
• Deep knowledge of Windows, Linux, and Active Directory security.
• Strong knowledge of network protocols and security.
• Strong experience with SIEM and EDR tools, including detection logic, log correlation, and threat analysis.
• Advanced digital forensics experience (memory, disk, log, network).
• Familiarity with evidence handling, chain-of-custody standards, and forensic reporting.
• Strong understanding of attack techniques and threat actor behaviours (MITRE ATT&CK).
• Experience in cloud investigations (Azure/AWS/GCP logs, identity, telemetry).
• Danish speaker – English only can be accommodated.

Responsibilities

• Lead complex and high-severity incident response engagements for customers across varied infrastructures (on-prem, cloud, hybrid).
• Perform advanced forensic analysis across data sources (disk, memory, network, malware, cloud) and provide actionable findings.
• Coordinate response activities with client teams, management, and legal/compliance contacts.
• Develop accurate incident timelines, attribution assessments, and root-cause analyses.
• Act as a trusted advisor to clients during and after incidents, guiding containment and recovery.
• Deliver professional technical reports and executive summaries for clients.
• Present findings to technical teams, senior leadership and non-technical stakeholders.
• Mentor junior team members during engagements and training.

Skills

Incident response

Digital forensics

Cloud investigations

Windows security

Linux security

SIEM

EDR tools

Client-facing communication

Leadership

Tools

Sentinel/Defender

CrowdStrike

Disk/memory forensics

Job description

Senior Security Consultant – Incident Response

Do you want to be on the frontline when serious cyber incidents hit? You will lead complex investigations, guide customers through crises, and help shape our incident response services. You will join a highly skilled, collaborative team working with some of the most interesting and challenging cyber cases in the market.

Make a real impact in high‑stakes incidents

You will be part of a small, expert Incident Response team handling everything from ransomware to targeted attacks across large, complex environments. You will work closely with customers, helping them stay calm, informed and in control during critical situations. You will collaborate with specialists across MDR, Intelligence and Consulting, learn from unique cases, and contribute to the development of tools, methodologies and publications. At CSIS, we invest in your growth with dedicated training time, certifications, and peer learning - in an open, diverse and friendly culture built on “We commit, We care, We succeed together.”

When you join CSIS, you will get an interesting job in a company and an industry which is growing. You will get interesting challenges, that truly make a difference for our customers, and you will be able to take ownership for your work from start to finish. And you will not least get 130+ fantastic colleagues from all over the world. Besides that, you will get:

Besides that, you will get:

Flexible work from home arrangements

A competitive salary and personal benefit package

5 weeks holiday, plus 5 extra days off each year

Health Insurance, a pension, plus life and disability insurance

Healthy, varied lunches (incl. vegetarian and allergy options)

Home-baked goods, healthy snacks, coffee, tea and sodas in the office

Social activities and company events throughout the year

Paid mobile phone subscription and home internet

In this client-facing role, you will lead major incident response engagements, support multiple customers, guide junior responders, and help clients strengthen their detection and response capabilities. You will work across diverse environments, industries, and technologies, making adaptability and strong communication essential.

Your responsibilities will be:

Incident Response & Investigations (Client-Facing)

Lead complex and high-severity incident response engagements for customers across varied infrastructures (on-prem, cloud, hybrid).

Perform advanced forensic analysis across a variety of data sources (disk, memory, network, malware, cloud) and provide clients with clear, actionable findings.

Coordinate response activities with client technical teams, management, and legal/compliance contacts.

Develop accurate incident timelines, attribution assessments (where possible), and root‑cause analyses.

Customer Communication & Advisory

Act as a trusted advisor to clients during and after incidents, providing guidance on containment, recovery, and long‑term improvements.

Deliver polished, professional technical reports and executive summaries for clients.

Present findings to technical teams as well as to senior leadership and non-technical stakeholders.

Assist clients with incident readiness assessments, IR playbook creation, tabletop exercises, and contribute to CSIS’s MDR detection engineering.

Contribute to development of internal incident response methodologies, tooling, and best practices.

Mentor and guide junior team members during engagements and internal training.

About you

You are an experienced incident responder who remains calm and structured under pressure. You enjoy working closely with customers, translating complex technical issues into clear business language, and you value collaboration and knowledge sharing. You are curious, proactive and driven by making a real difference in the fight against cybercrime.

You bring most of the following:

Qualifications & Technical Expertise

Hands‑on incident response experience, ideally in a consultancy, MSSP, DFIR, or CSIRT environment.

Proven track record leading multi‑client or multi‑environment incident investigations.

Deep knowledge of Windows, Linux, and Active Directory security.

Strong knowledge of network protocols and security

Strong experience with SIEM and EDR tools, including detection logic, log correlation, and threat analysis. Hands‑on experience with Sentinel/Defender and CrowdStrike a plus.

Advanced digital forensics experience (memory, disk, log, network).

Familiarity with evidence handling, chain‑of‑custody standards, and forensic reporting.

Strong understanding of attack techniques and threat actor behaviours (MITRE ATT&CK).

Experience in cloud investigations (Azure/AWS/GCP logs, identity, telemetry).

Consultancy‑Specific Requirements

Ability to manage multiple parallel client engagements and prioritize effectively.

Excellent client‑facing communication: confident, calm, and credible during crises.

Strong written documentation skills for both highly technical and non-technical readers.

Ability to scope engagements, set expectations, and represent the company professionally.

Regulatory & Governance Knowledge

Familiarity with European cybersecurity requirements, especially NIS2, GDPR breach handling, and relevant ISO standards.

Ability to advise clients on improving governance, detection maturity, and incident readiness.

Preferred Skills

Danish speaker – English only can be accomodated.

Threat hunting experience or development of hunting hypotheses.

Scripting/automation (Python, PowerShell, Bash).

Experience in red team/purple team activities or adversary emulation.

Experience providing IR training or running tabletop exercises.

GIAC: GCIH, GCIA, GCFA, GCFE, GPEN, GNFA.

OSCP, CISSP, CISM, or cloud security certs (Azure/AWS/GCP).

Equivalent real‑world experience also highly considered and appriciated.

Professional, customer‑oriented communication style.

Ability to remain composed and decisive under pressure.

Strong analytical mindset with attention to detail.

Leadership qualities and ability to mentor junior responders.

Curiosity and passion for threat research, attacker behaviour, and continuous learning.

This is a 24/7/365 function — flexibility, out-of-hours work, on‑call coverage and occasional travel is required.

Other conditions

Security Clearance: As you may work with some of our public sector customers, a Security Clearance may be required.

Relocation: The position is based out of our offices in Denmark, with some flexibility of remote working. Relocation can also be offered to Denmark if relevant