Consultant Security Incident Management

Project overview

For the establishment of a self-operated security environment, an experienced consultant in the field of Security Incident Management is sought. The goal of the project is the conception, piloting, and establishment of a security incident and CSIRT process, including methodological and organizational anchoring within a larger corporate structure.

Responsibilities

• Conception and establishment of a Security Incident Management and CSIRT process for a self-operated environment
• Methodological development and piloting of the defined processes
• Professional control and support of security incidents until the completion of their respective processing
• Creation and optimization of incident response workflows for environments with limited or no external connectivity
• Development of logging, monitoring, and detection requirements in tool-independent documentation
• Conception, moderation, and evaluation of security exercises and tabletop exercises
• Consulting on escalation and crisis communication processes with relevant stakeholders
• Consulting on regulatory requirements and reporting processes in the context of NIS2, BSIG, and GDPR

Requirements

Tool knowledge:

Experience with several of the following solutions:

• Several years of practical experience in establishing a Security Incident Management or CSIRT process within larger organizations
• Proven experience in independently handling and coordinating real security incidents
• Profound knowledge in the area of incident response using local analysis and forensic tools
• Very good knowledge of regulatory requirements according to NIS2, BSIG, and Art. 33 GDPR
• Experience in deriving logging and detection requirements
• Experience in planning and conducting security exercises and tabletop exercises
• 6 to 10 years of project experience in Security Incident Management
• Willingness for security screening SÜ2
• Case Management / Incident Tracking
• TheHive
• RTIR
• OTOBO / Znuny
• Jira Service Management
• SIEM / Log Management
• Wazuh
• Elastic Security
• Graylog
• OpenSearch

Project details

• Project published: 2026-10-26
• Start: 2026-11-02
• Duration: 12 months
• Postal code: DE RXXXX
• Industry: IT Services
• Utilization: 5 days per week remote
• CA Number: CA-103612
• Start: 02.11.2026
• Remote: remote
• Location: Mannheim, BW, DE
• Languages: German