Lead Security Consultant Security Management

Project overview

At virtual7, we combine our technological expertise with a deep understanding of our clients' needs. Through tailor-made solutions, we create real added value for our framework agreement partners in public administration. We are currently looking for a Lead Security Consultant Security Management (m/f/d) for one of our clients.

YOUR MISSION

At our client's site, work is being carried out in the area of Security Management.

• Project location: Bonn
• Period: November 16, 2026, to December 31, 2026
• Work mix: 30 days remote / 4 days on-site
• Important: Remote work only possible within Germany
• Important: Project language is German
• Important: Willingness for SÜ2 according to § 9 SÜG (Classified Information/Sabotage Protection)
• Extension for 2027 possible

Responsibilities

MUST-HAVES FOR THIS POSITION

NICE-TO-HAVES FOR THIS POSITION

If you are interested and currently have available capacity, we look forward to your application. Our recruiting team with Alicja Okuniewicz, Anna-Lena Röcker, Jörg Becker – looks forward to talking with you.

virtual7 Recruiting Team

Mail: *@*.de

JobLink: https://virtual7jobs.recruitee.com/o/lead-security-consultant-security-management-mwd

• Recording existing reporting, alarming, and response pathways, including established practices for disruptions and security incidents
• Design of the incident process covering detection, assessment, containment, eradication, recovery, and post-mortem
• Formulation of logging and telemetry requirements for relevant departments, including transfer from isolated zones
• Action guidelines for essential incident types
• Definition of reporting channels to management, external authorities (supervisory and data protection), and affected clients, with a reliable path from every zone
• Establishment of initial forensic capabilities, including evidence preservation, chain of custody, and controlled extraction of investigation material
• Regulation of analysis capabilities without manufacturer-operated analysis services; execution and evaluation of pilot exercises
• Roadmap for other incident types, including readiness and personnel models
• min. 6 years of experience building an incident or CSIRT process in a larger organization
• min. 6 years of experience personally leading real security incidents to completion
• min. 6 years of experience handling incidents in environments without remote access
• min. 6 years of experience with secure knowledge of reporting obligations and their deadlines according to NIS2 or BSIG and Article 33 GDPR
• min. 6 years of experience with evidence preservation, disk and memory forensics
• min. 6 years of experience with logging and detection rules from incident handling
• min. 6 years of experience with conception and execution of exercises
• min. 6 years of experience with crisis communication and escalation
• min. 6 years of experience with TheHive, RTIR, OTOBO/Znuny, Jira Service Management
• min. 6 years of experience with Wazuh, Elastic Security, Graylog, OpenSearch
• min. 6 years of experience with Sigma
• min. 6 years of experience with Velociraptor, Sleuth Kit/Autopsy, Volatility, dc3dd
• min. 6 years of experience with MISP, OpenCTI, YARA
• min. 6 years of experience with Cortex, Shuffle
• Experience with reporting chains in provider relationships: regulation of when and how affected clients are informed
• Experience with designing service agreements with external incident response providers for environments
• Experience with ransomware incidents, including recovery decisions

Project details

• Start: 2026-11
• Duration: 2 Monate
• Remote: hybrid
• Location: Bonn, Deutschland, DE
• Languages: German