Incident Responder Lead

• Lead incidents from initial assessment to closure. Establish scope, agree priorities, assign responsibilities and adjust the response as new evidence emerges
• Coordinate investigation and recovery. Bring responders, recovery specialists and client IT providers together around a clear plan, managing dependencies and resolving blockers
• Work across client infrastructure, including Windows, Active Directory, Microsoft 365, virtualization and backups. Bring in specialists where needed; expertise in every platform is not expected
• Guide clients through difficult decisions. Explain findings, recovery options and tradeoffs in plain language, keeping technical teams and business stakeholders informed
• Oversee safe restoration. Review recovery plans, challenge assumptions about backups and system dependencies, and ensure the checks supporting a return to service are documented
• Own the final report. Review and approve incident reports, ensuring conclusions, limitations and recommendations are clear and supported by evidence
• Coach responders, review their work and turn lessons learned into better recovery runbooks
• Lead the adoption of cutting-edge AI tools across incident response. Turn promising approaches into practical investigation, recovery and automation workflows, coach the team in their use, and validate results while protecting incident data

• Flexible work options - you work from home or our offices in Berlin and Cologne
• 28 Vacation Days - plus Christmas Eve & New Year’s Eve
• Competitive Compensation
  - Attractive salary & equity options
• Financial Support - subsidized Germany ticket and Wellpass membership, company pension support and corporate benefit access
• Continuous Learning
  - Support for your professional growth and development, both internally and through access to the Udemy Business platform
• Team & Social Events
  - Regular team events to get the entire team together from across Germany
• Challenging & Supportive Culture
  - Work with motivated colleagues in an environment where you can grow, achieve, and enjoy the journey

Practical experience applying AI tools to technical work, such as agentic workflows or information extraction, and assessing their reliability. Bring curiosity, openness to feedback and the ability to guide adoption

Experience using SIEM, EDR and forensic tools, such as Windows Defender for Business, Splunk, Crowd Strike, Velociraptor, X-Ways, KAPE, Hayabusa, SOF-ELK or Open Relik. These are examples; experience with comparable tools is equally relevant

Experience managing an incident, major outage or recovery project: defining scope, coordinating specialists and providers, tracking actions and dependencies, and escalating delivery risks

Experience writing incident or root-cause reports that explain evidence, findings, limitations and remediation clearly. You can take responsibility for the final report from the outset

Strong understanding of practical restoration, gained through delivering or supervising recovery in SMEs or comparable environments. You can assess plans, challenge assumptions and judge whether recovery checks are sufficient

Technical knowledge of backup and restore workflows and system dependencies, sufficient to review specialist recommendations and explain tradeoffs to clients

Clear communication, sound judgement about when to seek specialist help, and the ability to keep clients and colleagues aligned under pressure

Professional working proficiency in German and English to lead client and international partner discussions, explain technical decisions and provide written updates

Typically 3+ years of relevant experience in incident response, recovery, infrastructure or technical project delivery, including coordinating complex recovery work German - business fluent

English - business fluent

Experience with threat hunting and integrating threat intelligence into investigations to prioritise hypotheses, assess indicators of compromise and guide response decisions