About the role
When a client faces ransomware, a data breach or a compromised account, they need someone calm who has done this before. This role leads those engagements for clients in Switzerland and Germany. You set priorities for containment and recovery, run the incident bridge and keep executives, legal counsel and insurers informed. You also coordinate with authorities such as the NCSC and cantonal police where needed. Between incidents you run readiness reviews and tabletop exercises with client teams.
What you will do
- Lead incident response engagements and coordinate client IT, legal, communications and external parties
- Direct containment, eradication and recovery activities and record decisions
- Oversee forensic evidence collection and analysis by the technical team
- Prepare regulatory notifications and reports for FINMA, the FDPIC, the NCSC or the BSI with the client
- Run tabletop exercises and review incident response plans between engagements
What you bring
- 6+ years in security operations or incident response, including leading major incidents
- Sound knowledge of Windows and Active Directory, Microsoft 365 and common cloud platforms
- Experience with forensic and EDR tooling used in investigations
- Composure under pressure and clear communication with executives
- Willingness to join an on-call rota for urgent engagements
Good to have
- GIAC certification such as GCIH, GCFA or GCFR
- Experience working with cyber insurers and breach counsel
Languages
English (C1), German (B2)