Incident Response Consultant remote

Project details

October 2026

December 2027

Utilization: Full-time

Stuttgart Remote Share: 95%

Contract Type: Freelance

Area of Responsibility:

What you bring:

If the task sounds exciting to you, do not hesitate to contact me.

You are welcome to share the project in your network. Upon successful placement of a

colleague, you will receive a 250 EUR Amazon voucher as a thank you.

I look forward to your feedback!

SThree_Germany is acting as an Employment Business in relation to this vacancy.

• Analysis and evaluation of existing processes for Security Incident Management and digital forensics
• Conception, further development, and introduction of a holistic incident response and CSIRT process
• Definition of alerting channels, escalation levels, roles, responsibilities, and on-call models
• Creation of runbooks, playbooks, and instructions for action for various security incidents
• Development of reporting and communication processes according to NIS2, BSIG, and GDPR
• Setup and validation of processes for digital forensics and evidence preservation
• Definition of logging, monitoring, and telemetry requirements for detection and incident response
• Conducting workshops, tabletop exercises, and real pilot exercises with management participation
• Creation of target states, recommendations for action, and implementation strategies for regular operations
• Practical implementation and validation of the developed concepts in the pilot environment
• Several years of experience (6+ years) in the field of Incident Response, Cyber Defense, DFIR, or CSIRT
• Demonstrable experience in building and further developing security incident management processes
• Practical experience in managing and coordinating real security incidents
• Profound knowledge in Digital Forensics, evidence preservation, chain of custody, as well as memory and disk analysis
• Deep understanding of regulatory requirements such as NIS2, BSIG, and GDPR reporting obligations
• Experience in defining and implementing detection, logging, and monitoring requirements
• Very good knowledge of SIEM, IR, and DFIR tools such as Elastic Security, Wazuh, Graylog, OpenSearch, TheHive, Cortex, Velociraptor, or Volatility
• Experience with Threat Intelligence, Sigma Rules, YARA, MISP, OpenCTI, and MITRE ATT&CK
• Ability to communicate complex technical issues to management level in an audience-appropriate manner
• Experience in conducting crisis exercises, awareness measures, and escalation scenarios
• Independent, structured, and solution-oriented way of working
• Start: 2026-11
• Remote: hybrid
• Location: Bonn, Deutschland, DE
• Languages: German