Incident Response Lead (Germany)

About the role

Coalition is seeking its first Cyber Incident Response (CIR) hire in Germany to build and expand its incident response footprint. The role will serve German and regional customers, guiding them through forensic investigations, containment, and long‑term remediation while communicating complex technical concepts in both German and English.

Key responsibilities

• Lead incident response engagements, performing forensic analysis on Windows, Linux, and macOS systems.
• Coordinate assistance from internal team members and external vendors.
• Analyze firewalls, web, database, and other logs to uncover Indicators of Compromise.
• Produce detailed case reports for technical and business audiences.
• Assess customer security programs and recommend enhancements aligned with industry frameworks.
• Track emerging security practices and contribute to internal processes and product development.
• Support the growth of Coalition’s CIR presence in Germany by building trusted relationships with customers and partners.

Required profile

• Bachelor’s degree in Computer Science, Information Security, Engineering or related field.
• 5+ years of incident response or digital forensics experience.
• Strong knowledge of network threat lifecycles, attack vectors, and intrusion tactics.
• Fluency in German and English, with the ability to explain technical concepts to non‑technical stakeholders.

Required skills

• Forensic tools: Velociraptor, Axiom, FTK, SIFT, Volatility, ELK, Wireshark, Plaso, Skadi.
• Endpoint Detection and Response (EDR): CrowdStrike Falcon, Carbon Black, SentinelOne.
• Network protocols and analysis: TCP/IP, log and network traffic capture.
• Framework knowledge: NIST, HIPAA, PCI, GDPR.