Staff Cybersecurity Specialist – Incident Response (DE)
Eye Security · Remote · Germany ·
COMPENSATION
€•• – ••k
Listed on the employer's job board (Ashby)
- Staff level role
- Fully remote (EU)
- German C2 required
- Incident Response focus
- MDR environment
Join Eye Security as a senior individual contributor strengthening Incident Response and Security Operations. You will lead engagements from investigation to recovery, acting as a technical authority while supporting customers during critical cyber incidents.
Operating within a product-driven MDR environment, you will leverage large security datasets to protect over 1,000 European customers. This role offers the chance to improve security operations at scale alongside experts from intelligence and military backgrounds.
What you'll do
- Lead cyber incident response engagements from intake through recovery
- Act as technical lead during investigations and coordinate responses
- Conduct forensic investigations to determine attack scope and root cause
- Provide clear technical guidance to customers during active incidents
- Mentor junior and medior responders to raise team maturity
- Improve incident response methodologies, playbooks, and processes
- Collaborate with legal counsel, law enforcement, and regulators when needed
What you'll need
- 6+ years in cybersecurity with hands-on Incident Response experience
- Proven ability to lead and manage incidents end-to-end independently
- In-depth knowledge of Windows, Linux, and macOS operating systems
- Strong understanding of enterprise infrastructure and network security
- Experience with EDR platforms like CrowdStrike or SentinelOne
- Knowledge of cloud security across Azure, AWS, or Google Cloud
- Fluency in English and C2 fluency in German for client communication
- Experience mentoring or coaching other security professionals
Nice to have
- Experience developing scripts or tools for investigations
- Background in technical security research
- Knowledge of threat actor tactics, techniques, and procedures
- Prior work in CERT, CSIRT, MDR, or DFIR environments
Stack
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
- SentinelOne
- Windows
- Linux
- macOS
- Azure
- AWS
- Google Cloud
How you'll work
- Remote-friendly culture
- Quarterly meetups and annual retreats
- Reports to Director of Security Operations
What you get
- Generous time-off policy including wellbeing days
- Volunteering days included
- Thursday socials to stay connected
- Work with professionals from national CERTs and intelligence