Cyber defense specialist incident response

The Role

The specialist leads end-to-end incident response across the full lifecycle — from preparation and detection through containment, recovery and lessons learned. Day to day, this means conducting digital forensic investigations, analysing malware, reconstructing attacker behaviour, and translating findings into improved playbooks, detection logic and automated SOC processes. Participation in a 24/7 on-call rota is required.

Skills & Experience

Candidates need substantial experience in DFIR, incident response or a comparable cybersecurity role, with demonstrable knowledge of attack techniques, threat actor TTPs, ransomware and malware. Hands-on experience with forensic tooling, log analysis and endpoint investigation is essential. Comfort operating in both Dutch and English is expected in this bilingual team environment.

Who It Suits

This role suits an experienced IR or DFIR professional who combines technical depth with clear communication skills for management and executive stakeholders. Someone who thrives under pressure, enjoys continuous improvement, and wants to shape a next-generation tier-less SOC within critical national infrastructure will find this particularly rewarding.