Lead Security Consultant Incident Response / CSIRT (Expert) | 100% Remote

Project overview

Industry: IT Services & Consulting

For an organization with isolated zones, we are looking for a Lead Security Consultant for Incident Response and Forensics. 100% remote, starting immediately.

Responsibilities

Profile

Required:

Experience:

Advantageous:

Security Requirement

A security clearance is necessary for the project. It will be conducted anew for the project. Willingness is sufficient; an existing clearance is not required.

• Build incident/CSIRT process with tool-supported case management
• Lead real security incidents to completion
• Incident response without remote access and vendor services
• Implement reporting obligations (NIS2/BSIG, Art. 33 GDPR)
• Forensics: Evidence preservation, disk and RAM analysis, Chain of Custody
• Derive detection requirements, conduct tabletop exercises, and manage crisis communication
• Own leadership of real security incidents
• Forensics Tools: Velociraptor, Autopsy, Volatility
• SIEM: Wazuh, Elastic Security, Graylog or OpenSearch; Sigma rules
• Threat Intelligence: MISP, OpenCTI, YARA; Case Management: TheHive
• GCIH, GCFA or CISM advantageous
• Expert level
• German citizenship (security clearance required)
• Professional experience at Principal/Lead level
• TheHive
• Wazuh
• Velociraptor
• Volatility
• NIS2
• MITRE ATT&CK
• GCIH

Project details

Germany / 100% Remote

Immediately

Experience Level: Principal

Security Clearance: Willingness required

up to €690/day

• Start: 2026-11
• Remote: remote
• Location: Deutschland, DE
• Languages: German