Incident Response Consultant remote

Responsibilities

What you bring:

If the task sounds exciting to you, do not hesitate to contact me.

You are welcome to share the project in your network. Upon successful placement of a

colleague, you will receive a 250 EUR Amazon voucher as a thank you.

I look forward to your feedback!

SThree_Germany is acting as an Employment Business in relation to this vacancy.

• Analysis and evaluation of existing processes for Security Incident Management and Digital Forensics
• Conception, further development, and implementation of a holistic Incident Response and CSIRT process
• Definition of alerting channels, escalation levels, roles, responsibilities, and on-call models
• Creation of runbooks, playbooks, and action instructions for various security incidents
• Development of reporting and communication processes according to NIS2, BSIG, and GDPR
• Setup and validation of processes for digital forensics and evidence preservation
• Definition of logging, monitoring, and telemetry requirements for detection and incident response
• Conducting workshops, tabletop exercises, and real pilot exercises with management participation
• Creation of target states, recommendations for action, and implementation strategies for regular operations
• Practical implementation and validation of the developed concepts in the pilot environment
• Several years of experience (6+ years) in Incident Response, Cyber Defense, DFIR, or CSIRT
• Demonstrable experience in building and further developing security incident management processes
• Practical experience in managing and coordinating real security incidents
• Profound knowledge in Digital Forensics, evidence preservation, chain of custody, and memory and disk analysis
• Deep understanding of regulatory requirements such as NIS2, BSIG, and GDPR reporting obligations
• Experience in defining and implementing detection, logging, and monitoring requirements
• Very good knowledge of SIEM, IR, and DFIR tools such as Elastic Security, Wazuh, Graylog, OpenSearch, TheHive, Cortex, Velociraptor, or Volatility
• Experience with Threat Intelligence, Sigma Rules, YARA, MISP, OpenCTI, and MITRE ATT&CK
• Ability to communicate complex technical issues to management level in an audience-appropriate manner
• Experience in conducting crisis exercises, awareness measures, and escalation scenarios
• Independent, structured, and solution-oriented way of working

Project details

October 2026

December 2027

Utilization: Full-time

Stuttgart Remote Share: 95%

Contract Type: Freelance

• Start: 01/11/2026
• Duration: Dezember 2027 Auslastung: Vollzeit Einsatzort: Stuttgart Remote-Anteil: 95%
• Remote: hybrid
• Location: Bonn, Nordrhein-Westfalen, Deutschland, DE
• Rate: 95-105 EUR/h
• Languages: German