Freelance Incident Response Consultant

Project overview

A German service provider, exclusively specializing in information security, is currently supporting a major bank in Abu Dhabi in managing a serious security incident. The assignment ranges from containment and forensic analysis to rebuilding the security organization.

As a Freelance Incident Response Consultant, you will be at the forefront of an active major incident. You will push the attacker out of the environment, reconstruct their path through the infrastructure, and secure evidence in a way that law enforcement agencies can use.

Responsibilities

What you bring:

• Containment and eradication in a compromised banking infrastructure: Isolation of affected systems, disruption of C2 communication, and revocation of compromised identities
• Host, memory, and network forensics to reconstruct initial access, lateral movement, persistence, and data exfiltration
• Threat hunting for remaining persistence mechanisms and derivation of IOCs and TTPs along MITRE ATT&CK
• Court-admissible evidence securing with a complete chain of custody as a basis for prosecution
• Collaboration with law enforcement agencies and national CERT structures in cross-border investigations
• Situation reports and decision papers for the bank's crisis management team and management
• Handover of forensic findings to Detection Engineering and Security Architecture for subsequent hardening
• Completed university degree or vocational training with corresponding professional experience
• Several years of experience in DFIR, ideally in large ransomware or APT incidents in environments with several thousand endpoints
• Practical experience with Velociraptor, KAPE, Volatility, Plaso/Timesketch, X-Ways, Magnet AXIOM, or EDR-based forensics via CrowdStrike or Microsoft Defender for Endpoint
• Solid understanding of Active Directory and Entra ID attack paths, as well as experience in compromise recovery of Tier-0 assets
• Experience in forensic evidence securing for criminal proceedings
• Certifications such as GCFA, GCFE, GNFA, or GREM are an advantage
• Very good German and business-fluent English skills

Project details

• Start: ab sofort
• Remote: remote
• Location: Deutschland, Deutschland, DE
• Languages: German

Source notes

Are you interested? Then we look forward to receiving your application documents and are available for any questions in an initial conversation.

• Involvement in an active major incident in the banking sector, where your analyses directly guide decisions
• Full-time engagement over a project duration of 3 to 6 months
• Rotation model with two alternating teams: two weeks in Abu Dhabi, two weeks in Germany
• Full coverage of all travel expenses
• Option for permanent employment, including unlimited vacation