Incident Responder (German speaking)

• Execute containment and forensic investigation of ransomware, business email compromise and other incidents: preserve evidence, analyse host and identity logs, and develop findings with specialist guidance
• Support systems restoration after cyber incidents: assess backups, rebuild servers and endpoints, resolve dependencies and validate services before returning them to use
• Work with client IT teams and managed service providers across Windows, Active Directory, Microsoft 365, virtualisation and backup environments
• Document technical work and communicate progress, uncertainties and blockers, escalating risks to the lead
• Put cutting-edge AI tools to work in investigations, recovery and automation. Experiment with new approaches, validate results and help shape how the team adopts them, while protecting incident data
• Improve recovery checklists, scripts and playbooks by sharing lessons from casework

Benefits

• Flexible work options - you work from home or our offices in Berlin and Cologne
• 28 Vacation Days - plus Christmas Eve & New Year’s Eve
• Competitive Compensation - Attractive salary & equity options
• Financial Support - subsidized Germany ticket and Wellpass membership, company pension support and corporate benefit access
• Continuous Learning - Support for your professional growth and development, both internally and through access to the Udemy Business platform
• Team & Social Events - Regular team events to get the entire team together from across Germany
• Challenging & Supportive Culture - Work with motivated colleagues in an environment where you can grow, achieve, and enjoy the journey

Basic experience documenting technical work in tickets, change logs or recovery notesProfessional working proficiency in German and English for client discussions, written updates and coordination with international response partnersOpenness to coaching and feedback, and motivation to develop your security and investigation skills2+ years of hands-on experience in IT support, systems administration, recovery or incident responsePractical experience using AI tools for technical tasks, such as information extraction, log analysis or agentic workflowsExperience using SIEM, EDR and forensic tools, such as Windows Defender for Business, Splunk, CrowdStrike, Velociraptor, X-Ways, KAPE, Hayabusa, SOF-ELK or OpenRelik. (These are examples; experience with comparable tools is equally relevant.)English - business fluentGerman - business fluentStrong practical restoration experience, ideally with SMEs or small IT teamsHands-on troubleshooting and backup or restore knowledge, with willingness to learn unfamiliar technologiesFamiliarity with threat hunting and using threat intelligence to guide investigations, prioritize suspicious activity and assess indicators of compromise