Lead Cyber Security Specialist – Digital Forensics

Forensic Focus Limited; Utrecht; On-site; EUR 53,000 - 68,000; Full time

Job summary

Forensic Focus Limited, based in Zeist/Netherlands, seeks a Lead Cyber Security Specialist in Digital Forensics to join a high‑security government defence environment onsite. You will lead complex DFIR investigations and incident response, guiding teams through containment, evidence collection, and recovery efforts.

You will analyse cyber incidents, develop hypothesis-driven threat hunting strategies, and communicate findings clearly to military and defence units.

Qualifications

• At least five years of cybersecurity and digital forensics experience.
• Deep knowledge of networks, malware analysis, and detection techniques.
• Proficiency in Python and PowerShell scripting.
• SANS or GIAC certifications required.
• Experience developing hypothesis-driven threat hunting strategies.

Responsibilities

• Lead and coordinate complex digital forensic investigations and incident response activities.
• Analyse cyber incidents and direct technical compromise investigations.
• Support recovery efforts and advise defence units on digital resilience.
• Communicate findings clearly to stakeholders at all levels.
• Lead a DFIR team in a high-security government environment.

Skills

Cybersecurity

Digital forensics

Threat hunting

Python

PowerShell

Malware analysis

Network security

Job description

# Lead Cyber Security Specialist – Digital Forensics*Ministerie van Defensie***Zeist, Utrecht**Onsite · Lead/Principal · Full-time### The RoleWorking within a dedicated DFIR team at a national defence cyber security centre, this role involves leading and coordinating complex digital forensic investigations and incident response activities. Day-to-day responsibilities include analysing cyber incidents, directing technical compromise investigations, supporting recovery efforts, and advising defence units on improving their digital resilience.### Skills & ExperienceCandidates require at least five years of experience in cybersecurity and digital forensics, with deep knowledge of networks, malware analysis, and detection techniques. Proficiency in scripting languages such as Python and PowerShell is essential, as are relevant SANS/GIAC certifications. Experience developing hypothesis-driven threat hunting strategies is also required.### Who It SuitsThis position suits an experienced DFIR professional ready to take a lead technical role in a high-stakes government defence environment. Those with a strong investigative background, a collaborative mindset, and the ability to communicate complex forensic findings clearly to stakeholders at all levels will thrive here.Typical advertised salary forDigital Forensics roles in Netherlands:**€53,000–€68,000**(median €59,000 — from17 recent listings analysed by Forensic Focus).Compare Digital Forensics salaries in Netherlands →Certifications mentioned:SANS — find training for these on theDFIR Training Finder.Learn More/Apply