Senior Digital Forensics and Incident Response Consultant
NTT DATA Europe & Latam
Ettlingen, Baden-Württemberg
The Role
The consultant investigates security incidents across enterprise networks, servers and endpoints, performing host-based and network forensic analysis, including live and dead-box examination. Responsibilities include malware reverse engineering, root cause analysis, drafting IR playbooks, running tabletop exercises, and producing reports for both technical and management audiences.
Skills & Experience
Candidates should hold a degree in computer science or equivalent and demonstrate strong knowledge of Windows, macOS, Unix/Linux and mobile forensics. SANS certifications such as GCFE, GCFA, GNFA or GREM are advantageous. Familiarity with MITRE ATT&CK and NIST frameworks, plus fluent German and English, is required.
Who It Suits
This role suits an experienced DFIR professional who thrives in a client-facing consulting environment, is comfortable with on-call duties and travel, and wants to operate across a broad range of incident types — from initial triage through to proactive readiness and remediation engagements.
Typical advertised salary for Incident Response roles in Germany: €81,000–€115,000 (median €87,000 — from 14 recent listings analysed by Forensic Focus).
Compare Incident Response salaries in Germany →
Certifications mentioned: GCFA · GCFE · GREM · GNFA · SANS — find training for these on the DFIR Training Finder.
