Lead Incident Response Manager - Enterprise & Crisis (EMEA)

Check Point Software Technologies; Madrid; On-site; EUR 75,000 - 110,000; Full time

Job summary

Check Point Software Technologies is seeking an experienced Incident Response Team Leader to guide a team of IR analysts supporting enterprise customers across EMEA. This role centers on hands-on cyber incident management, customer engagement, threat containment, and operational excellence from Madrid and beyond.

You will lead investigations, coordinate triage and recovery, and deliver executive-level briefings while driving readiness and collaboration across security teams in a fast-paced

Qualifications

• 5+ years of Incident Response or DFIR experience.
• Strong knowledge of ransomware, cloud, identity, and enterprise investigations.
• Excellent customer-facing communication and stakeholder management skills.
• Experience leading remote teams in high-pressure environments.
• Proficient with EDR, SIEM, threat intel, and forensic investigation tools.
• GIAC, GCFA, GCIH, CISSP, or similar certifications.

Responsibilities

• Lead and mentor a team of Incident Response analysts during active security incidents
• Serve as the primary customer-facing lead during investigations and crisis situations
• Coordinate incident triage, containment, eradication, and recovery efforts
• Deliver executive-level communications, incident briefings, and post-incident reporting
• Drive operational readiness, process improvement, and collaboration across security teams

Skills

Incident Response

DFIR

Customer-facing

Remote team leadership

EDR

SIEM

Threat intelligence

Forensic tools

Certifications (GIAC GCFA GCIH CISSP)

Job description

Check Point Software Technologies is seeking an experienced Incident Response Team Leader to guide a team of IR analysts supporting enterprise customers across EMEA. This role centers on hands-on cyber incident management, customer engagement, threat containment, and operational excellence from Madrid and beyond.

You will lead investigations, coordinate triage and recovery, and deliver executive-level briefings while driving readiness and collaboration across security teams in a fast-paced