Senior Digital Forensics and Incident Response Consultant
NTT DATA Europe & Latam
Wolfsburg, Lower Saxony
The Role
Consultants investigate attacks on corporate networks, servers and hosts, performing live and dead-box host forensics, network-level analysis and malware reverse engineering. They lead active incident response engagements, conduct root cause analysis, and develop proactive IR artefacts such as playbooks, tabletop exercises and client training.
Skills & Experience
Candidates should hold a degree in computer science or equivalent and demonstrate strong expertise across Windows, macOS, Linux and mobile forensics. SANS certifications including GCFE, GCFA, GNFA or GREM are advantageous. Familiarity with MITRE ATT&CK and NIST frameworks is expected, alongside malware static and dynamic analysis experience.
Who It Suits
This role suits an experienced DFIR professional comfortable working both on active incidents and on proactive security engagements. The position requires business-level German and English, a willingness to travel, and the flexibility to participate in on-call arrangements for urgent client incidents.
Typical advertised salary for Incident Response roles in Germany: €81,000–€110,000 (median €86,000 — from 13 recent listings analysed by Forensic Focus).
Compare Incident Response salaries in Germany →
Certifications mentioned: GCFA · GCFE · GREM · GNFA · SANS — find training for these on the DFIR Training Finder.
