Incident Responder Lead

Lead incidents from initial assessment to closure. Establish scope, agree priorities, assign responsibilities and adjust the response as new evidence emerges. Coordinate investigation and recovery across client infrastructure, bringing responders, recovery specialists and client IT providers together around a clear plan.

What you'll do

• Lead incidents from initial assessment to closure. Establish scope, agree priorities, assign responsibilities and adjust the response as new evidence emerges.
• Coordinate investigation and recovery. Bring responders, recovery specialists and client IT providers together around a clear plan, managing dependencies and resolving blockers.
• Work across client infrastructure, including Windows, Active Directory, Microsoft 365, virtualization and backups. Bring in specialists where needed; expertise in every platform is not expected.
• Guide clients through difficult decisions. Explain findings, recovery options and tradeoffs in plain language, keeping technical teams and business stakeholders informed.
• Oversee safe restoration. Review recovery plans, challenge assumptions about backups and system dependencies, and ensure the checks supporting a return to service are documented.
• Own the final report. Review and approve incident reports, ensuring conclusions, limitations and recommendations are clear and supported by evidence.
• Coach responders, review their work and turn lessons learned into better recovery runbooks.
• Lead the adoption of cutting-edge AI tools across incident response. Turn promising approaches into practical investigation, recovery and automation workflows.

What you'll need

• Professional working proficiency in German and English to lead client and international partner discussions, explain technical decisions and provide written updates.
• Typically 3+ years of relevant experience in incident response, recovery, infrastructure or technical project delivery, including coordinating complex recovery work.
• Strong understanding of practical restoration, gained through delivering or supervising recovery in SMEs or comparable environments.
• Experience managing an incident, major outage or recovery project: defining scope, coordinating specialists and providers, tracking actions and dependencies, and escalating delivery risks.
• Technical knowledge of backup and restore workflows and system dependencies, sufficient to review specialist recommendations and explain tradeoffs to clients.
• Experience using SIEM, EDR and forensic tools, such as Windows Defender for Business, Splunk, CrowdStrike, Velociraptor, X-Ways, KAPE, Hayabusa, SOF-ELK or OpenRelik.
• Experience writing incident or root-cause reports that explain evidence, findings, limitations and remediation clearly.
• Practical experience applying AI tools to technical work, such as agentic workflows or information extraction, and assessing their reliability.

Nice to have

• Experience with threat hunting and integrating threat intelligence into investigations to prioritise hypotheses, assess indicators of compromise and guide response decisions.

What they offer

• Flexible working – work from home two days per week, office in Berlin three days per week
• 28 vacation days plus Christmas Eve and New Year's Eve
• Competitive salary and VSOP equity options
• Subsidized Germany ticket, Wellpass membership and company pension support
• Professional development support and Udemy Business platform access
• Regular team events across Germany