Incident Response Analyst & Incident Manager

Join Conscia's CSIRT and combine digital investigation with the responsibility for guiding customers safely through the incident

Cyberattacks rarely strike at a convenient time. When they do, our customers need overview, calm and answers about what has actually happened. Would you like to be there when we help them through the difficult hours – and learn from some of Denmark's most skilled specialists in the field? Then you might be our new Incident Response Analyst and Incident Manager.

We are strengthening our CSIRT (Computer Security Incident Response Team) and are looking for a colleague who can both dig into the digital evidence and take responsibility for the process, the documentation and the dialogue with the customer. You do not need a long career behind you – but you do need the right mindset, a solid technical understanding, a sense of structure and the drive to grow into the role quickly. With us, you get real responsibility, close sparring with experienced colleagues and the opportunity to develop faster than you would in a traditional security role.

Your role
You will be part of our CSIRT and work side by side with experienced analysts and consultants when our customers are hit by security incidents. The position covers two roles: as Lead Analyst, you structure and lead the technical investigation, and as Incident Manager, you coordinate the engagement and ensure structure, overview and alignment with the customer. During active incidents, you will as a rule be responsible for only one of these roles, but the role may vary from incident to incident depending on who you are on call with.

Lead Analyst
As Lead Analyst, you are responsible for structuring and guiding the technical investigation within the agreed scope of the incident. This means that you:

• Support technical triage.
• Identify the relevant investigation approaches.
• Maintain the investigation plan.
• Coordinate the analytical direction.
• Support the prioritisation of technical response activities.

You support the Incident Manager by providing the technical findings, investigation status, recommendations and forensic input required for decision-making, customer communication and reporting.

You provide the technical leadership required to maintain investigation quality, scope control, technical consistency and effective use of the assigned analysts and supporting specialists.

In the analytical work, you will among other things:

• Take part in incident response engagements: Contribute to handling security incidents at customers, from the initial data collection to closure and lessons learned.
• Analyse digital evidence: Examine logs, endpoint telemetry, system artefacts and other digital evidence to determine what the attacker has done.
• Find the cause: Contribute to identifying attack vectors, root cause and the extent of the compromise.
• Document and report: Prepare technical notes, timelines and findings that form the basis of our incident reports.
• Communicate technical findings: Explain what the investigation shows, clearly and precisely, to both specialists and decision-makers.
• Develop the CSIRT: Contribute to improving our playbooks, tools and analysis methods.
• Join the on-call rota: After an introduction period, become part of the team's on-call rota, so we can help customers whenever an incident occurs.

Incident ManagerAs Incident Manager, you are responsible for coordinating an incident response engagement once the CSIRT has been activated. You establish and maintain the response structure for the incident, including:

• Customer alignment.
• The agreed work scope.
• Coordination of priorities with the Lead Analyst.
• Visibility of planned effort and time consumption.
• Coordination of assigned responders and supporting resources.
• Resource activation when additional capacity, specialist knowledge, operational support or escalation is required.

You are responsible for ensuring that customer authority, approval boundaries, work scope, planned effort and time consumption are understood – both before and during activities with customer impact.

If personnel without CSIRT Foundation training are assigned to an Incident Response Team, you ensure that they understand the applicable incident response structure as well as the expectations regarding confidentiality, documentation and procedural boundaries.

In addition, you will among other things be responsible for:

• Customer onboarding & readiness: Introducing new customers to Conscia's Incident Response process and ensuring clear, up-to-date process and procedure manuals.
• Documentation & reporting: Preparing incident reports that describe the course of events, causes and concrete recommendations.
• Status meetings & customer dialogue: Conducting quarterly status meetings and sharing relevant insights on improvements, trends and new threat landscapes.
• Process development: Contributing to the continuous improvement and optimisation of our incident response processes.
• Cooperation with authorities: Coordinating with the police and forensics specialists in connection with digital investigations and evidence collection.
• Knowledge sharing: Turning new knowledge and current threats into practical advice and learning for both customers and colleagues.

Who are you?
Both roles carry real responsibility during active incidents, so we are looking for someone with solid, hands-on experience in incident response. You do not need to be senior, but you must have the experience needed to lead a technical investigation and to coordinate an engagement with confidence. We imagine that you:

• Have solid practical experience with incident response and digital forensics – for example from a CSIRT, a SOC or a consulting role – and have worked on real incidents from initial triage to closure and reporting.
• Can plan and drive a technical investigation: choose the relevant investigation approaches, set priorities, keep the work within the agreed scope and guide other analysts along the way.
• Have a strong technical understanding of Windows and/or Linux and of how an enterprise environment is built, including Active Directory, networking and logging.
• Have experience coordinating incidents or other time-critical work across several parties, and are comfortable aligning scope, priorities, effort and time consumption with the customer.
• Are used to writing incident reports and presenting findings and recommendations to both technical specialists and decision-makers.
• Have an analytical and structured approach and keep focus and overview when the pressure is high.
• Speak and write English fluently. Danish is not a requirement.
• Want to take ownership of processes, documentation and customer relationships – not only of the technical analysis.

It is an advantage if you also have

• Experience with EDR tools such as Microsoft Defender, CrowdStrike or SentinelOne.
• Knowledge of Microsoft 365, Entra ID and Azure – and preferably AWS or Google Cloud.
• Experience with disk or memory analysis, log analysis or malware triage.
• Scripting or development skills (e.g. Python or PowerShell).
• Certifications or hands-on training from e.g. SANS/GIAC, OffSec, Hack The Box, TryHackMe, CyberDefenders, Blue Team Labs or 13Cubed. Experience from CTFs, a home lab or your own projects counts too.
• Experience with incident management, incident coordination or emergency preparedness work.
• Experience with preparing processes, procedures or reports for management level.
• Knowledge of evidence preservation and cooperation with the police or other authorities.
• Experience from consulting or customer-facing roles.

Your personal strengths

• Curious and quick to learn: You like to dig into things, ask questions and understand how and why attacks succeed.
• Analytical and thorough: You can get an overview of complex situations and separate what matters from what does not.
• Calm under pressure: You maintain structure and overview in pressured situations and handle change calmly.
• Strong communicator: You can turn complex technical events into clear messages, recommendations and reports.
• Structured and responsible: You take responsibility for seeing agreements, processes and follow-up all the way through.
• Team player: You thrive in an environment where people share knowledge, help each other and draw on each other's skills.
• Customer-oriented: You want to help and create a sense of security for customers in critical situations.

Conscia offers
You will be part of a professionally strong and ambitious team, where attention to detail, collaboration and well-being are at the centre. Among other things, you get:

• A structured introduction and close sparring with experienced colleagues, so you are quickly equipped for the role.
• A versatile role that combines technical investigation with customer responsibility, and experience from many different types of incidents at customers across industries.
• Opportunities for continuous competence development, training and certifications within DFIR, incident response and incident management.
• The opportunity to grow with the tasks and develop towards a senior role as you gain experience.
• A flexible setup with mutual trust and room for both deep work and teamwork.

In addition to a competitive salary package, we offer an attractive pension and health scheme, a lunch scheme and a modern office environment.

Next steps
If you have questions or would like to know more about the position, you are welcome to contact the Manager of the Incident Response team, Peter Sindt, on +45 22 63 36 56.

We hold interviews on an ongoing basis, so feel free to send your CV today.

About Conscia
Conscia is a leading European provider of IT security and business-critical IT infrastructure based on solutions from, among others, Cisco, Palo Alto, VMware, Microsoft Azure and a wide range of other technology partners. Conscia has a strong focus on advanced cybersecurity, including monitoring, detection and handling of security incidents, compliance, and protection of complex and regulated IT environments.

The ambition is to be the preferred partner for organisations with critical IT infrastructure throughout the entire lifecycle – from strategic advice and architecture design to implementation, operations and continuous optimisation.

Conscia A/S employs more than 1,500 people and is represented in Denmark, Sweden, Norway, Germany, the Netherlands, Belgium, the United Kingdom, Ireland, Finland and Slovenia.