C

Coalition

Active cyber insurance with risk management

Incident Response Lead

Security Operations & Incident ResponseConfirmed live in the last 24 hours
Full-timeRemote in Germany

About the Job

Requirements

  • Fluent German and English at a minimum C1 level are required.
  • A bachelor's degree in Computer Science, Information Security, Engineering, or a related field is required.
  • At least five years of experience in incident response or digital forensics is required.
  • Demonstrated practical knowledge of network threat and attack lifecycles, attack vectors, exploitation methods, and threat-group tactics, techniques, and procedures is required.
  • Knowledge of TCP/IP protocols, network assessment, and network and security applications, including analysis of logs and network traffic captures, is required.
  • Experience with Velociraptor, Axiom, FTK, SIFT, Volatility, ELK, Wireshark, Plaso, Skadi, or other open-source tools for forensic analysis, log analysis, or network assessment is required.
  • Experience with endpoint detection and response tools such as CrowdStrike Falcon, Carbon Black, or SentinelOne is required.
  • Knowledge of industry standards and frameworks including NIST, HIPAA, and PCI is required.
  • Familiarity with the GDPR and awareness of German and EU legal frameworks, including privacy and incident-handling requirements, is required.
  • Experience using tools in AWS is required; the statement is incomplete in the posting.
  • Strong analytical skills and experience diagnosing and resolving technical problems are required.
  • Experience using command-line interfaces and ability to learn new technologies and concepts are required.
  • Experience guiding teams of analysts is required.
  • Ability to explain highly technical information to non-technical audiences is required.
  • Experience working with customers in high-priority scenarios is required.
  • Project management knowledge is required.
  • Flexibility to work outside regular hours during urgent response needs, including supporting Central European business hours as needed, is required.
  • Ability to operate effectively as an early employee in a new market and collaborate across functions is required.

Responsibilities

  • Lead incident-response engagements, guiding customers through forensic investigations, containing security incidents, and recommending long-term remediation.
  • Coordinate and guide incident-response support provided by team members and external service providers.
  • Investigate customer data breaches and malicious activity using forensic tools; analyze Windows, Linux, and Mac OS X systems to identify indicators of compromise; and examine firewall, web, database, and other logs for evidence of malicious activity.
  • Provide case reports for internal and external audiences as needed, tailoring technical detail to threat researchers and business customers.
  • Assess customers’ security programs, technologies, controls, and business environments, and recommend and develop improvements.
  • Provide solution recommendations to help customers address information-security risks.
  • Track emerging security practices and contribute to building internal processes and the company’s products.
  • Track the current regulatory environment, industry trends, and related implications, including security and privacy requirements relevant to Germany and the EU.
  • Help grow Coalition’s incident-response presence in Germany as an early team member by building trusted relationships with local customers and partners.
  • Contribute to professional development in the digital forensics and incident response industry.

Desired Qualifications

  • GCIH, GCIA, GCFA, GCFE, ACE, EnCE, CFCE, CISSP, or comparable certifications are preferred.
  • Experience in security policy, governance, privacy, or regulation, such as NIST, ISO, HIPAA, or PCI, is preferred.
  • Familiarity with security practices and frameworks relevant to Germany or the EU, such as GDPR or BSI-compliant environments, is preferred.
  • Experience securing cloud platforms such as Microsoft Azure or Amazon AWS is preferred.
  • Experience with system-hardening practices for Windows, Linux, or Unix is preferred.
  • Knowledge of or experience with Nmap, Nessus, Nexpose, Qualys, Burp, Kali, Metasploit, Meterpreter, or other offensive tools is helpful.
  • Scripting experience for developing security tools and knowledge of industry frameworks are helpful.
  • Experience with SCADA or control-system networks is preferred.

About the Company

cb

Coalition

Active cyber insurance with risk management

Coalition blends Active Insurance with proactive cybersecurity tools to help businesses prevent digital risk. Its platform, Coalition Control, delivers automated cyber alerts, risk-management guidance, and third-party risk management. The company differentiates itself as the world’s first Active Insurance provider, backed by partnerships with major insurers and its own insurer, Coalition Insurance Company, plus Coalition Security Labs for education and insights. Its goal is to prevent cyber incidents by combining risk transfer with proactive protection to help organizations manage digital risk more effectively.

Company size
501-1,000
Company stage
Series F
Total funding
$770M
Headquarters
San Francisco, CA
Founded
2017

Recently Posted Jobs

Explore more opportunities at Coalition

See more jobs