All positions
AI content
·POSITION · GAD-4771
Digital Forensics and Incident Responder (f/m/d)
When an attack is under way at a customer, you are there: you help contain it, secure evidence in a court-proof way, find out how the attackers got in and help bring the systems back safely. This is our incident response and forensics service.
AI content
Your responsibilities
- You respond to security incidents such as ransomware, compromised accounts or suspicious access, remotely or on site at the customer
- You secure evidence using recognised forensic methods with a documented chain of custody: disk and memory images, log data, cloud and email accounts
- You analyse how the attack unfolded: initial access, spread through the network, affected data. This includes malware analysis and targeted searches for further traces in SIEM and EDR data (threat hunting)
- You support containment and recovery and advise management during a crisis, including on reporting obligations under NIS 2 and the GDPR
- You write clear reports for technical teams, management and, where needed, insurers or authorities
- You work closely with our SOC and pentest team and help customers with incident response plans and exercises so the next incident runs faster
Your profile
- Several years of hands-on IT security experience, for example as SOC analyst, incident responder, pentester or administrator with a security focus
- Confident in Windows and Active Directory environments, good knowledge of Linux, networks and cloud (for example Microsoft 365 and Azure)
- Experience with forensic and analysis tools such as X-Ways, Magnet AXIOM, FTK Imager, Velociraptor, Volatility or KAPE and with EDR systems
- Certifications such as GCFA, GCIH or equivalent are a plus
- Calm, careful work under time pressure and discretion with sensitive data
- As an employee rotating on-call duty with the team, as a freelancer deployments by arrangement, plus willingness for short-notice deployments at customers, driving licence
- Fluent German, good English
What awaits you
- Real cases instead of theory: every incident is different
- A team of SOC, pentest and GRC with whom you follow each case from detection to prevention
- Direct contact with management at the moments that matter
- Room to help build our incident response and forensics service
Your benefits with us
- Permanent or freelance, as you prefer. As a freelancer you take on individual deployments for a fee per deployment and can have other clients
- As an employee, on-call duty is paid, deployments outside working hours are compensated and certifications such as GCFA or GCIH are paid for
- 30 days of vacation, company pension, public transport allowance (for permanent staff)
- Your own lab environment and access to the GAD Academy
·FEEDBACK
Rate us on kununu
Whether you have just been through our application process or work with us, we welcome honest, constructive feedback. It helps us get better.