Cybersecurity Incident Responder

Andersen Lab; Osterreich; On-site; PEN 269,000 - 423,000; Full time

Benefits offered by this job

Private health insurance

Sports compensation

Mentoring and adaptation program

Access to corporate training portal

Referral program

Annual bonus potential up to €1,000

Job summary

Andersen Lab is seeking a Cybersecurity Incident Responder to safeguard critical systems and manage security incidents in a complex international environment. You will work across multi-tenant settings and coordinate with client IT teams to ensure rapid, effective containment and recovery.

The role requires hands-on incident response experience, proficiency with modern EDR/XDR tools, and strong forensic skills. On-call rotation and ongoing security improvements are core parts of the job.

Qualifications

• 5+ years in cybersecurity, with 3+ years in hands-on incident response.
• Experience handling end-to-end incidents (ransomware, data exfiltration).
• Hands-on with EDR/XDR tools (Defender, CrowdStrike, SentinelOne).
• Forensic analysis using memory/disk tools (Volatility, KAPE, Velociraptor).
• Experience in Microsoft 365, Entra ID and Azure incident handling.
• Familiarity with NIST SP 800-61 or SANS incident handling.
• Available for on-call rotation; background check ready.
• Upper-intermediate+ English.

Responsibilities

• Execute full incident lifecycle: triage, containment, eradication, recovery, lessons learned.
• Perform digital forensics on endpoints, servers, and cloud workloads.
• Investigate escalated SOC alerts to determine scope and impact.
• Coordinate response activities with clients, IT teams, and management.
• Develop and maintain IR playbooks and runbooks; run tabletop exercises.
• Write incident reports and root-cause analyses; recommend remediation.
• Participate in on-call rotation with rapid response windows.

Skills

Incident response

Cybersecurity operations

On-call readiness

English communication

Tools

EDR/XDR tools

Defender for Endpoint

CrowdStrike

SentinelOne

Volatility

KAPE

Velociraptor

FTK/EnCase

Microsoft 365

Entra ID

Azure

Python scripting

PowerShell scripting

Job description

This role is not available in your region. View other available roles .

Summary

Andersen is hiring a Cybersecurity Incident Responder for a project protecting critical systems and managing security incidents in a complex international environment.

The customer is a large international organization that relies on modern technology and digital solutions to support its operations. Its activities involve secure IT infrastructure, data management, digital services, and the adoption of emerging technologies to improve operational efficiency and reliability.

The project is focused on providing cybersecurity and digital services for international organizations within a complex multi-tenant environment. It includes cyber defense operations, security incident management, and continuous protection of critical systems and services to ensure secure and reliable operations worldwide.

Responsibilities

• Executing the full incident lifecycle: triage, containment, eradication, recovery and lessons learned.
• Performing digital forensics on endpoints, servers and cloud workloads (disk, memory, logs).
• Investigating escalated alerts from the SOC and determine the scope and impact of incidents.
• Coordinating response activities with affected client organizations, IT teams and management.
• Developing and maintaining IR playbooks and runbooks, and run tabletop exercises.
• Writing incident reports and rooting cause analyses, and recommend remediation.
• Taking part in on-call rotation (response within 15 minutes, system access within 1 hour).

Requirements

• Experience in cybersecurity for 5+ years, including 3+ years in hands-on incident response.
• Proven end-to-end handling of real incidents (e.g. ransomware, BEC, account compromise, data exfiltration).
• Hands-on EDR/XDR experience (e.g. Microsoft Defender for Endpoint, CrowdStrike, SentinelOne).
• Forensic tools and techniques: memory and disk analysis (e.g. Volatility, KAPE, Velociraptor, FTK/EnCase), Windows and Linux artifacts.
• Investigation in Microsoft 365, Entra ID and Azure environments.
• Strong knowledge of NIST SP 800-61 or SANS incident handling frameworks.
• Readiness for on-call rotation.
• Clean record, ready for background verification.
• Level of English – from Upper-Intermediate and above.

Desired skills

• Certifications: GCIH, GCFA, GCFE, GNFA, ECIH.
• Cloud forensics in AWS or GCP.
• Malware triage and basic reverse engineering.
• Scripting in Python or PowerShell.
• Experience in a MSSP or a multi-tenant environment.

Reasons to join us

• Experience in teamwork with leaders in FinTech, Healthcare, Retail, Telecom, and others. Andersen cooperates with such businesses as Samsung, Siemens, Johnson & Johnson, BNP Paribas, Ryanair, Mercedes, TUI, Verivox, Allianz, T-Systems, etc..
• The opportunity to change the project and/or develop expertise in an interesting business domain.
• Guarantee of professional, financial, and career growth! The company has introduced systems of mentoring and adaptation for each new employee.
• The opportunity to earn up to an additional 1,000 EUR per month, depending on the level of expertise, which will be included in the annual bonus, by participating in the company's activities.
• Access to the corporate training portal, where the entire knowledge base of the company is collected and which is constantly updated.
• Referral program.
• Private health insurance and sports compensation, depending on the type of employment.

Locations

Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Hungary, Italy, Latvia, Lithuania, Luxembourg, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, The Netherlands