Senior Incident Response Lead | Ransomware & DFIR Expert

Forensic Focus; Rotterdam, Den Haag; Hybrid; EUR 66,000 - 84,000; Full time

Job summary

Forensic Focus is seeking a Lead Incident Response professional to head a DFIR team in the Netherlands. You will guide investigations from intake through reporting, while managing rostering and delivery KPIs, and acting as incident commander for major cases.

Fluent English and Dutch are required, with a strong background in DFIR, EDR platforms, cloud security, and attacker TTPs. The role combines leadership with hands-on incident response in a client-facing environment.

Qualifications

• 6+ years hands-on incident response and digital forensics experience.
• Strong knowledge of DFIR methodology, EDR platforms, cloud security and attacker TTPs.
• Proven people-management experience.
• Fluent English and Dutch.

Responsibilities

• Lead the incident response team from intake to client reporting.
• Manage rostering, oversee delivery KPIs, and act as incident commander for major incidents.
• Provide hands-on involvement in high-pressure, client-facing casework.
• Balance coaching and leadership with ongoing frontline duties.

Skills

DFIR

Digital Forensics

EDR

Cloud security

TTPs

People management

English&Dutch

Tools

Automation tools

Job description

Forensic Focus is seeking a Lead Incident Response professional to head a DFIR team in the Netherlands. You will guide investigations from intake through reporting, while managing rostering and delivery KPIs, and acting as incident commander for major cases.

Fluent English and Dutch are required, with a strong background in DFIR, EDR platforms, cloud security, and attacker TTPs. The role combines leadership with hands-on incident response in a client-facing environment.