Incident Manager

Join Conscia's CSIRT and take charge when our customers face their most critical moments

Cyberattacks rarely strike at a convenient time. When they do, our customers need someone who brings calm, structure and direction – someone who keeps everyone aligned while the technical work moves forward. Would you like to be that person, and lead some of the most significant cyber incidents in the Nordics? Then you might be our new Incident Manager.

Our Cybersecurity Incident Response Team (CSIRT) handles many of the largest cybersecurity incidents in Europe. The team consists of dedicated experts in digital forensics, advanced infrastructure, recovery and incident management, who work together to solve the most challenging situations. We have helped countless organisations recover from cyberattacks and get back to business with minimal impact.

We are now strengthening the team with a dedicated Incident Manager. In this role, your focus is not on the forensic analysis itself, but on leading the engagement: driving progress, aligning priorities, coordinating stakeholders and acting as the customer's trusted advisor from the first call until the incident is closed.

Your role
As Incident Manager, you are responsible for coordinating incident response engagements once the CSIRT has been activated – from initial response through containment, forensic investigation and recovery to post-incident activities. You work closely with multidisciplinary teams of forensic investigators, recovery specialists, infrastructure experts, legal advisors and customer stakeholders, and you are the one who ensures that everyone is working towards the same goal.

Leading the engagement
You establish and maintain the response structure for the incident, including:

• Customer alignment and the agreed work scope.
• Coordination of priorities with the Lead Analyst.
• Visibility of planned effort and time consumption.
• Coordination of assigned responders and supporting resources.
• Resource activation when additional capacity, specialist knowledge, operational support or escalation is required.

You ensure that customer authority, approval boundaries, work scope, planned effort and time consumption are understood – both before and during activities with customer impact. The Lead Analyst provides you with technical findings, investigation status and recommendations, which you translate into decisions, customer communication and reporting.

If personnel without CSIRT Foundation training are assigned to an Incident Response Team, you ensure that they understand the applicable incident response structure as well as the expectations regarding confidentiality, documentation and procedural boundaries.

Key responsibilities

• Lead incident response engagements: Coordinate cybersecurity incidents from activation to closure and lessons learned, and drive recovery efforts to minimise business disruption and downtime.
• Primary point of contact: Act as the customer's main contact during incidents and as a trusted advisor to IT management, executives and other stakeholders.
• Cross-functional coordination: Coordinate technical and business specialists – internally at Conscia and with the customer's own teams and third parties.
• Status meetings & crisis communication: Run status meetings and briefings during incidents, and keep decision-makers informed with clear, timely updates.
• Documentation & reporting: Ensure incident documentation is kept up to date, and prepare incident reports that describe the course of events, causes and concrete recommendations.
• Cooperation with authorities: Coordinate with the police and forensics specialists in connection with digital investigations and evidence collection.
• Customer onboarding & readiness: Introduce new customers to Conscia's Incident Response process, ensure clear and up-to-date process and procedure manuals, and hold recurring status meetings sharing insights on improvements, trends and the threat landscape.
• Resilience after the incident: Support customers in strengthening their resilience and preparedness once the incident is over.
• Develop the CSIRT: Contribute to the continuous improvement of our incident response processes, playbooks and methodologies.
• Join the on-call rota: After an introduction period, become part of the team's on-call rota, so we can help customers whenever an incident occurs.

Who are you?
We believe you have a background in cybersecurity, IT operations, managed services, consulting, technical account management, service delivery, project coordination or a similar field. You enjoy working with both technical specialists and business stakeholders, bringing structure to challenging situations and helping teams prioritise their work towards a common goal. We imagine that you:

• Have experience leading major incidents, service disruptions or crisis situations – ideally in a time-critical setting with many parties involved.
• Understand how modern IT environments and services are built, operated and supported, including Active Directory, networking, cloud and logging – well enough to follow the technical work and ask the right questions.
• Have experience advising senior leadership and executive stakeholders, and can communicate clearly under pressure.
• Are comfortable aligning scope, priorities, effort and time consumption with the customer.
• Build trusted relationships easily with both technical specialists and business stakeholders.
• Have strong problem-solving skills and a pragmatic mindset.
• Are used to writing reports and presenting findings and recommendations to decision-makers.
• Have professional proficiency in English, both written and spoken.

It is an advantage if you also have

• Experience within cybersecurity incident response, digital forensics, SOC operations or managed security services.
• Professional proficiency in English.
• Understanding of compliance, regulatory, legal and information protection requirements, e.g. NIS2, GDPR and DORA.
• Knowledge of cyber risk management, business continuity, crisis management and resilience.
• Experience with cloud security and hybrid IT environments, e.g. Microsoft 365, Entra ID and Azure.
• Knowledge of evidence preservation and cooperation with the police or other authorities.
• Experience from consulting or customer-facing advisory roles.
• Certifications or training within incident management, crisis management, ITIL, project management or incident response (e.g. SANS/GIAC).

Your personal strengths

• Calm under pressure: You maintain structure and overview in pressured situations and handle change calmly.
• Natural coordinator: You bring order to chaos, set priorities and make sure things actually move forward.
• Strong communicator: You turn complex technical events into clear messages, decisions and recommendations.
• Trusted advisor: You create a sense of security for customers in critical situations and earn the trust of executives and specialists alike.
• Structured and responsible: You take responsibility for seeing agreements, processes and follow-up all the way through.
• Team player: You thrive in an environment where people share knowledge, help each other and draw on each other's skills.

Conscia offers
You will be part of a professionally strong and ambitious team, where attention to detail, collaboration and well-being are at the centre. Among other things, you get:

• A structured introduction and close sparring with experienced colleagues, so you are quickly equipped for the role.
• A central role in some of the largest and most complex cyber incidents in Europe, across many industries.
• Opportunities for continuous competence development, training and certifications within incident management, crisis management and incident response.
• The opportunity to take on increasing responsibility as you develop your leadership, stakeholder management and crisis coordination capabilities.
• A flexible setup with mutual trust and room for both deep work and teamwork.

In addition to a competitive salary package, we offer an attractive pension and health scheme, a lunch scheme and a modern office environment.

Due to the sensitivity of our assignments, we require EU citizenship.

Next steps
If you have questions or would like to know more about the position, you are welcome to contact the Manager of the Incident Response team, Peter Sindt, on +45 22 63 36 56.

We hold interviews on an ongoing basis, so feel free to send your CV today.

About Conscia
Conscia is a leading European service provider of IT security and business-critical IT infrastructure based on solutions from, among others, Cisco, Palo Alto, VMware, Microsoft Azure and a wide range of other technology partners. Conscia has a strong focus on advanced cybersecurity, including monitoring, detection and handling of security incidents, compliance, and protection of complex and regulated IT environments.

The ambition is to be the preferred partner for organisations with critical IT infrastructure throughout the entire lifecycle – from strategic advice and architecture design to implementation, operations and continuous optimisation.

Conscia A/S employs more than 1,500 people and is represented in Denmark, Sweden, Norway, Germany, the Netherlands, Belgium, the United Kingdom, Ireland, Finland and Slovenia.