Lead Security Consultant Security Incident Management (m/f/d) +++ FREELANCE +++VZ +++ 12M+ ++ REMOTE

Project overview

For our client, we are looking for a freelancer for the following role / project in full-time and remote:

Lead Security Consultant Security Incident Management (m/f/d)

Build-up and implementation of a continuous Security Incident Management process including Incident Response and digital forensics for on-premises infrastructures and isolated network zones.

Responsibilities

Must-haves

Nice-to-haves

Further Experience

Project Results

If interested, I need your current CV (in WORD) with your remote hourly rate by Monday, 10/12/2026 eob.

Additionally, a self-assessment (1=Basic knowledge / 5=Expert knowledge) for EACH of the above points (each line = one rating).

Tolga Yelkenci

Manß & Partner GmbH

*@*.de

• Analysis and further development of existing incident response processes, roles, and escalation paths
• Conception and implementation of a continuous incident management process from detection and assessment through containment and eradication to restart and lessons learned
• Definition of severity models, alerting chains, readiness regulations, and reporting deadlines
• Creation of technical runbooks and incident response playbooks for relevant incident types
• Definition of logging, telemetry, and detection requirements in collaboration with adjacent security areas
• Building initial forensic capabilities including evidence preservation, chain of custody, and controlled extraction of investigation material
• Conception of incident response in isolated network zones without remote access or vendor-operated analysis platforms
• Design of internal and external reporting channels, considering regulatory requirements, especially NIS2/BSIG and GDPR
• Technical implementation and testing of processes and tools in pilot operation
• Conducting an incident response exercise with technical teams and decision-makers
• Definition of roles, responsibilities, and interfaces, as well as creation of a roadmap for regular operations
• 6-10 years of practical experience in Security Incident Management, Incident Response, or CSIRT build-up
• Proven experience in building and further developing incident response processes, not exclusively in operational roles
• Independent management of real security incidents from initial assessment to completion
• Experience with incident response in on-premises and isolated environments without direct remote access
• Profound knowledge in incident triage, containment, root cause analysis, recovery, and lessons learned
• Experience with digital forensics, especially disk and memory analysis, evidence preservation, and chain of custody
• Knowledge of regulatory reporting obligations and deadlines, especially NIS2/BSIG and Art. 33 GDPR
• Experience with defining logging, telemetry, and detection requirements, as well as formulating detection rules
• Conception and execution of incident response exercises, including crisis communication and decision paths
• Experience with incident management and analysis tools, as well as their independent technical implementation
• Ability to communicate security incidents in a structured and understandable manner to management and decision-makers
• Very good German language skills, spoken and written
• Incident Management and SIEM
• TheHive, RTIR, OTOBO/Znuny or Jira Service Management
• Wazuh, Elastic Security, Graylog or OpenSearch
• Digital Forensics and Incident Response
• Velociraptor, Sleuth Kit/Autopsy, Volatility or dc3dd
• Experience with evidence preservation and forensic investigations without cloud-based analysis tools
• Threat Intelligence and Detection Engineering
• MISP, OpenCTI, YARA and Sigma
• MITRE ATT&CK and structured attack pattern analysis
• Automation of response measures with Cortex or Shuffle
• Ransomware incident response including restart and recovery decisions
• Provider and tenant management for security incidents in jointly operated platforms
• Design of response models with external incident response service providers with limited or no remote access
• Preparation of threat intelligence and detection rules for offline environments
• Incident response in public cloud environments and transfer of procedures to own operations
• Collaboration with security authorities and supervisory bodies
• Certifications such as GCIH, GCFA, CISM or comparable
• Documented target state for Security Incident Management and digital forensics
• Defined roles, responsibilities, escalation and reporting paths
• Implemented runbooks and incident response playbooks
• Documented logging, telemetry, and forensic requirements
• Successfully conducted and evaluated pilot exercise
• Recommendations for action and roadmap for transfer to regular operations

Project details

• Start: ab sofort
• Duration: 12 Monate
• Location: DE
• Rate: 12-12 EUR/h
• Languages: German