НидерландыLead Incident Response
2 нед. назад
НидерландыLeadHybrid
incident responsedfirforensicsransomwarebusiness email compromiseteam leadershipclient communication
Lead and manage an incident response team handling complex cybersecurity cases and client communications.
О компании
- We are looking for an Incident Response Lead to join our Security Operations department.
- You will lead the people who own our most serious cases end to end — coordinating ransomware and business email compromise investigations, doing the forensic work, and being the person on the phone when a client needs a straight answer under real pressure.
- Your first responsibility is people, not just process. You’re a first-line manager distinct from a senior individual contributor, with direct accountability for the performance and development of your team — while carrying enough hands-on DFIR credibility to run the most complex case yourself, or take over one mid-flight, when the situation demands it.
- provides cybersecurity with embedded cyber insurance solutions for organisations across Europe. Headquartered in the Netherlands, we combine 24/7 detection and response with hands-on incident response to keep SMEs protected, and we’re growing internationally. When a client’s worst day happens, this is the team that shows up.
Обязанности
- Lead, coach, and develop the Incident Response team: regular one-to-ones, feedback, and performance/development conversations aligned with Eye’s career framework
- Lead by doing: manage the caseload and the people, but personally take point on the most complex or highest-profile incidents when needed
- Own end-to-end incident response service quality: case intake and coordination, technical execution, client communication, and closure/reporting
- Own delivery KPIs (time-to-containment, case-report quality and timeliness, client satisfaction on incident cases) and step in to unblock the team or personally lead a case when targets are at risk
- Manage on-call and case-lead rostering and workload across the team, prioritising by severity and client exposure
- Act as the senior escalation point and, when needed, incident commander for major incidents — large ransomware, multi-entity BEC, or cases with legal/regulatory exposure
- Own quality assurance for incident reporting: set the reporting standard and run structured peer review of case reports before they reach the client
- Own and scale automation across the function’s casework (evidence collection, timeline building, reporting), partnering with engineering where it makes sense
- Drive continuous improvement of IR playbooks, tooling, and process as case volume grows; keep runbooks and SOPs accurate and actually used
- Represent Incident Response in cross-functional discussions with SOC, Prevention, Product, Customer Success, and Legal where relevant
Требования
- Technical: 6+ years of hands-on incident response / digital forensics experience with deep, current knowledge of DFIR methodology, EDR platforms, cloud security, and attacker TTPs; able to personally run a complex case, not just sign off on one
- Leadership: composure and sound judgement under real pressure, often with incomplete information, during live incidents; strong incident-report writing and a sharp eye for reviewing others’ reports; clear, calm, authoritative communication with clients and internal stakeholders during a crisis
- People management: proven experience leading or supervising a technical team through high-pressure, time-critical work, with a genuine interest in coaching people and helping them grow; first-line management experience or a strong informal leadership track record
- Fluent English; Dutch (C2) required for client-facing work
Будет плюсом
- Background in a CERT, CSIRT, MDR, or DFIR-focused environment
- Experience handling cases with legal or regulatory exposure
- Scripting/automation experience applied to investigation workflows
- Familiarity with compliance frameworks relevant to SMEs (NIS2, ISO 27001, GDPR)