FREELANCE Lead Cyber Incident Responder

Cqure; Noord-Holland; On-site; EUR 90,000 - 130,000; Full time

Job summary

Cqure is seeking an experienced Lead Cyber Incident Responder who can combine deep technical expertise with calm leadership during serious security incidents. You will act as the technical escalation point for complex incidents and coordinate responses across IT, security, and business stakeholders.

In this role you lead containment, eradication and recovery efforts, bridge the gap between technology and the business, and contribute to tabletop exercises, playbooks and continuous improvement of

Qualifications

• Hands-on Incident Response experience
• Strong SOC/SIEM background
• Experience handling complex security incidents
• Ability to translate security topics for non-technical stakeholders
• Mentor junior responders and support on-call operations

Responsibilities

• Lead security incidents from detection through containment, eradication and recovery
• Investigate complex incidents across endpoints, servers, cloud, identity and network telemetry
• Coordinate with Security, IT Operations, Cloud, Identity, Legal, Privacy and Communications
• Contribute to tabletop exercises, incident simulations, purple teaming and playbooks
• Bridge technology and business needs during incidents and ongoing security cases

Skills

SOC/SIEM expertise

Incident response

Incident coordination

Mentoring

Communication

Tools

Microsoft Sentinel

Microsoft Defender

SIEM

EDR

NDR

SOAR

Threat Intelligence

Forensic tooling

Log platforms

Job description

For a large international organisation, we are looking for an experienced Lead Cyber Incident Responder who can combine strong technical depth with calm operational leadership during serious security incidents. You lead the incidents.

You act as the technical escalation point for complex incidents coming from Tier 1 and Tier 2 teams and continuously switch between deep technical investigation, incident coordination and communication with the wider business.

What will you do?

• You lead security incidents from detection and triage through containment, eradication and recovery.
• You investigate complex incidents across endpoints, servers, cloud environments, identity and network telemetry.
• You will work with technologies such as: Microsoft Sentinel, Microsoft Defender, SIEM, EDR and NDR, SOAR and Threat Intelligence, Forensic tooling and log platforms
• During major incidents, you take technical control of the response. You define priorities, coordinate actions and make sure the right teams are involved at the right moment, including Security, IT Operations, Cloud, Identity, Legal, Privacy and Communications.
• You can see yourself as the conductor during a cyber incident: coordinating multiple operational teams without being their direct manager.
• Approximately 20 to 30% of the role focuses on bridging the gap between technology and the business.
• You will also contribute to tabletop exercises, incident simulations, purple teaming and the continuous improvement of Incident Response processes, runbooks and playbooks.

What are we looking for?

An experienced Incident Response professional who:

• Strong SOC/SIEM background
• Has hands on Incident Response experience
• Has worked on complex security incidents
• Has strong knowledge of Microsoft Sentinel and Defender
• Understands containment, eradication and recovery
• Remains calm and structured under pressure
• Can coordinate multiple technical teams during an incident
• Can translate complex security topics for non technical stakeholders
• Can mentor and support more junior responders
• Is comfortable participating in an on call structure

The environment is highly dynamic. During quieter periods, you will work with the team on regular security cases and continuous improvement. When a major incident occurs, priorities can change immediately and the focus shifts fully towards managing and resolving the incident.

You will join a mature Incident Response environment with significant responsibility and close interaction with senior security stakeholders.