Incident Response Expert (m/f/d) AI-Augmented Cyber Incident Response ID27153-2

Incident Response Expert (m/f/d) AI-Augmented Cyber Incident Response ID27153-2

Duration: 21.09.2026 – 31.03.2027

Volumen: 40h/week

Location: remote

Please submit your profiles in English!

Project description: “Defending the Castle” is the short-term and immediate phase of our Customers AI threat resilience response. The purpose is to buy time by increasing detection, response, containment and recovery readiness while a broader Phase 2 plan is prepared for the rest of the Business IT units. 

Task description:

-   Conceptual development and structured implementation of the immediate incident response workstream for “Defending the Castle”, focused on AI-augmented attacks that may progress at machine speed.

-   Creation of practical response playbooks and SOPs for identity compromise, cloud control-plane abuse, endpoint intrusion, lateral movement, ransomware-style disruption and data-impact scenarios.

-   Definition of decision points for containment, escalation, evidence preservation, communication, legal/regulatory handover and crisis coordination.

-   Provision of technical consultation and recommendations to SOC, threat intelligence, security monitoring, infrastructure, application, Azure, on-premise and resilience teams.

-   Establishment and technical definition of a repeatable operating model for response readiness, evidence collection, handover and post-incident improvement before end of Q1 2027.

-   Provision of technical consultation to enable fast, consistent and controlled response to AI-assisted cyber incidents across hybrid Azure and on-premise landscapes.

-   Predefinition and documentation of roles, triggers, containment options, and communication paths to optimize incident response workflows

-   Development of guidelines to facilitate responder action when critical thresholds are reached.

-   Conversion of lessons from exercises and response reviews into improved playbooks, SOPs and control requirements. 

Quality

-    Technical preparation of scenario walkthroughs for validation by SOC, Cyber Defense,   

legal/compliance, cloud, infrastructure and resilience stakeholders.

-   Assessment of exercise results against time-to-triage, time-to-contain, decision latency and handover quality.

-   Usability testing of playbooks by responders who did not author them.

-   Creation of a Management-ready dashboard for readiness gaps, residual risks and agreed next actions.

-   Identification and technical gap analysis of existing processes (too slow, fragmented, undocumented or dependent on informal knowledge) to document optimization potential.

-   Transformation of risk discussion Transformation of risk evaluations into executable playbooks, technical control frameworks, test protocols, backlog items and management evidence.

-   Provision of a structured handover of a Phase 2 backlog and recommendations for the broader Business IT resilience plan after Q1 2027.

-   Creation of comprehensive documentation with all results regarding the above-mentioned tasks with subsequent handover to our customer for review and approval for further usage.

Skills

Please submit profiles in english for the Incident Response Expert.

• Minimum 8 years in incident response, cyber defense operations, crisis management, digital forensics or security operations leadership.

• Hands-on experience responding to identity compromise, ransomware, cloud compromise, endpoint intrusion and lateral movement incidents.

• Strong understanding of Microsoft security stack, Azure/Entra ID response actions, EDR isolation, forensic triage and evidence preservation.

• Proven ability to coordinate cross-functional technical and management stakeholders during high-pressure situations.

• Relevant certifications such as GCIH, GCFA, GNFA, CISSP, CISM, SC-200, AZ-500 or equivalent are beneficial.