Security Consultant Incident Management

Project overview

Activities:

• Setup and independent implementation of a security incident and CSIRT process in pilot operation for a self-operated environment.
• Independent management and coordination of security incidents from initial assessment to closure.
• Conception and implementation of incident response procedures for environments without remote access and external manufacturer analysis services.
• Derivation of logging and detection requirements as well as definition of suitable processes for security incident detection.
• Planning and execution of tabletop exercises including crisis communication, escalation, and involvement of decision-makers.

Requirements

• 6-10 years of professional experience in Security Incident Management.
• Experience in building incident and CSIRT processes in larger organizations, including tool-supported case management.
• Experience in independently managing real security incidents to completion.
• Knowledge in incident response without remote access, including on-site procedures and local tooling without manufacturer analysis services.
• Knowledge of reporting obligations and deadlines according to NIS2, BSIG, and Art. 33 GDPR, including reporting channels from zones without external connectivity.
• Ability to derive logging and detection requirements in tool-independent notation.
• Experience in the conception and execution of security exercises, especially tabletop exercises with decision-makers.
• Experience with crisis communication and escalation to management.
• Experience with case management tools, e.g., TheHive, RTIR, OTOBO/Znuny, or Jira Service Management.
• Experience with SIEM and log tools, e.g., Wazuh, Elastic Security, Graylog, or OpenSearch.

Project details

• Start: ab sofort
• Duration: 14 Monate
• Remote: remote
• Location: Düsseldorf, Deutschland, DE
• Languages: German