Incident Response Expert (m/f/d) AI-Augmented Cyber Incident Response ID27153-2

Incident Response Expert (m/f/d) AI-Augmented
Cyber Incident Response ID27153-2

Duration: 21.09.2026 – 31.03.2027

Volumen: 40h/week

Location: remote

Please submit your profiles in
English!

Project description: “Defending the
Castle” is the short-term and immediate phase of our Customers AI threat
resilience response. The purpose is to buy time by increasing detection,
response, containment and recovery readiness while a broader Phase 2 plan is
prepared for the rest of the Business IT units. 

Task description:

-   Conceptual development and structured implementation of the immediate
incident response workstream for “Defending the Castle”, focused on
AI-augmented attacks that may progress at machine speed.

-   Creation of practical response playbooks and SOPs for identity
compromise, cloud control-plane abuse, endpoint intrusion, lateral movement,
ransomware-style disruption and data-impact scenarios.

-   Definition of decision points for containment, escalation, evidence
preservation, communication, legal/regulatory handover and crisis coordination.

-   Provision of technical consultation and recommendations to SOC, threat
intelligence, security monitoring, infrastructure, application, Azure,
on-premise and resilience teams.

-   Establishment and technical definition of a repeatable operating model
for response readiness, evidence collection, handover and post-incident
improvement before end of Q1 2027.

-   Provision of technical consultation to enable fast, consistent and
controlled response to AI-assisted cyber incidents across hybrid Azure and
on-premise landscapes.

-   Predefinition and documentation of roles, triggers, containment options,
and communication paths to optimize incident response workflows

-   Development of guidelines to facilitate responder action when critical
thresholds are reached.

-   Conversion of lessons from exercises and response reviews into improved
playbooks, SOPs and control requirements. 

Quality

-    Technical preparation of scenario walkthroughs for validation by SOC,
Cyber Defense,   

legal/compliance, cloud,
infrastructure and resilience stakeholders.

-   Assessment of exercise results against time-to-triage, time-to-contain,
decision latency and handover quality.

-   Usability testing of playbooks by responders who did not author them.

-   Creation of a Management-ready dashboard for readiness gaps, residual
risks and agreed next actions.

-   Identification and technical gap analysis of existing processes (too
slow, fragmented, undocumented or dependent on informal knowledge) to document
optimization potential.

-   Transformation of risk discussion Transformation of risk evaluations
into executable playbooks, technical control frameworks, test protocols,
backlog items and management evidence.

-   Provision of a structured handover of a Phase 2 backlog and
recommendations for the broader Business IT resilience plan after Q1 2027.

-   Creation of comprehensive documentation with all results regarding the
above-mentioned tasks with subsequent handover to our customer for review and
approval for further usage.

Skills

Please
submit profiles in english for the Incident Response Expert.

•
Minimum 8 years in incident response, cyber defense operations, crisis
management, digital forensics or security operations leadership.

•
Hands-on experience responding to identity compromise, ransomware, cloud
compromise, endpoint intrusion and lateral movement incidents.

•
Strong understanding of Microsoft security stack, Azure/Entra ID response
actions, EDR isolation, forensic triage and evidence preservation.

•
Proven ability to coordinate cross-functional technical and management
stakeholders during high-pressure situations.

•
Relevant certifications such as GCIH, GCFA, GNFA, CISSP, CISM, SC-200, AZ-500
or equivalent are beneficial.