Principal Incident Response Consultant

Senior / Principal Incident Consultant

Incident Response Consultancy | Germany / DACH / UK Remote

Salary: £70,000–£100,000 DOE

Location: Germany, DACH region or UK-based (remote)

Working arrangement: Remote, with minimal travel

The Opportunity

We are working with a specialist Incident Response consultancy that supports organisations, insurers and legal professionals in responding to complex cyber security incidents.

Due to continued demand for its services and the need to strengthen its European delivery capability, the business is looking to appoint an experienced Senior or Principal Incident Responder.

This is an opportunity to join a technically focused consultancy where you will take ownership of live investigations, lead incident response engagements and work directly with clients during high-pressure situations.

The role will suit someone who enjoys remaining hands-on technically, while having the experience and confidence to independently manage investigations and communicate findings to senior stakeholders.

Key Responsibilities

• Lead and manage ransomware, Business Email Compromise (BEC) and other cyber incident investigations.
• Conduct digital forensic investigations, collecting and analysing evidence to understand threat actor activity and attack methods.
• Perform Windows host-based forensics and support data recovery and decryption during ransomware incidents.
• Prepare detailed investigation reports and present findings to clients, insurers, legal professionals and other stakeholders.
• Manage multiple investigations and ensure technical delivery is completed to a high standard.
• Work alongside external partners during ransomware extortion incidents.
• Contribute to the development of internal services, investigation processes and proprietary software.

Experience & Technical Requirements

• 5–10 years' experience within Incident Response, Digital Forensics or Cyber Investigations.
• Strong practical experience investigating ransomware, BEC and other cyber security incidents.
• Extensive experience with digital forensic tools and Windows host-based investigations.
• Experience managing investigations independently and handling multiple engagements.
• Previous experience within a consultancy, professional services or incident response environment.
• Strong client-facing communication skills, including the ability to present technical findings clearly.
• Understanding of evidence collection, storage and chain-of-custody procedures.
• Fluent German language skills are essential for this European opportunity.

Additional Technical Experience

Experience with some of the following would be beneficial:

• EDR solutions such as SentinelOne, CrowdStrike or Carbon Black.
• Splunk, Elastic and other log analysis platforms.
• Velociraptor and other digital forensic investigation tools.
• Linux, macOS and Active Directory environments.
• Python or PowerShell scripting.
• Live memory analysis and malware investigation.
• Azure virtual machines and storage.
• Malware sandboxing and reverse engineering.

Relevant certifications such as GCFA, GCFE, GCIH, GREM, CREST or EnCE would also be advantageous.

What We're Looking For

We are keen to speak with experienced Incident Responders who can combine strong technical investigation skills with the confidence to lead client engagements independently.

Whether you're currently operating at Senior or Principal level, the key is your ability to take ownership of complex incidents, deliver technically sound investigations and contribute to a growing specialist consultancy.

Interested?

If you're a German-speaking Incident Response professional considering your next move, I'd be interested in having a confidential conversation.