Senior Digital Forensics and Incident Response Consultant
NTT DATA Europe & Latam
Rosenheim, Bavaria
The Role
The consultant supports clients in preparing for and responding to security incidents, performing host-level forensic analysis (live and dead-box), network forensics, malware reverse engineering, and root cause analysis. The role also covers proactive IR activities such as IR plan development, playbook creation, tabletop exercises, and stakeholder training.
Skills & Experience
A degree in computer science or equivalent IT qualification is required, alongside strong expertise in Windows, macOS, Linux, network, and mobile forensics. Experience in static and dynamic malware analysis is essential. Familiarity with MITRE ATT&CK and NIST frameworks is expected, and SANS certifications such as GCFE, GCFA, GNFA, or GREM are advantageous.
Who It Suits
This role suits an experienced DFIR professional who is comfortable operating across both technical and management audiences, writing detailed incident reports, and working on-call when required. Fluent German and English are needed, along with a willingness to travel to client sites across the DACH region.
Typical advertised salary for Digital Forensics roles in Germany: €51,000–€75,000 (median €51,000 — from 18 recent listings analysed by Forensic Focus).
Compare Digital Forensics salaries in Germany →
Certifications mentioned: GCFA · GCFE · GREM · GNFA · SANS — find training for these on the DFIR Training Finder.
