Cybersecurity Incident Response & Digital Forensics Manager

This Hamburg-based role serves as the European anchor for a global incident response function, picking up investigations at the point where external MSP triage ends and driving them through to root cause and formal closure. Day to day, the work involves building detailed timelines, correlating indicators of compromise, providing technical direction to the MSP during live incidents, and producing reports that communicate clearly to both technical and executive audiences. The position also carries responsibility for covering global incidents independently outside regional hours and contributing to playbook development as the team expands. Strong hands-on experience investigating business email compromise, network intrusion, and ransomware is essential, along with proficiency in Microsoft Defender EDR. This suits a seasoned IR or DFIR professional — not a SOC analyst background — who is comfortable making sound, independent judgements under pressure and communicating confidently across all levels of an organisation.