Incident Response & DFIR Lead (Cybersecurity)

Location: Europe; remote work opportunity available

Company

hirify.global is hiring for a cybersecurity incident response and digital forensics leadership role.

What you will do

• Lead incident response, containment, forensic coordination, eradication and recovery for confirmed and major security incidents.
• Act as Incident Commander, assign incident roles, maintain investigation timelines, evidence and decision logs, and track remediation actions.
• Coordinate investigations across endpoints, servers, identities, cloud platforms, SaaS environments and network telemetry.
• Direct forensic collection and analysis to determine attack paths, scope, persistence and impact while preserving evidence for Legal, HR, regulatory and post-incident needs.
• Coordinate containment and recovery with IAM, Platform, IT, Security Engineering, Product and other technical owners, escalating high-impact decisions to Cyber Defense leadership and the CISO.
• Develop playbooks, forensic checklists and containment procedures, lead post-incident reviews and exercises, identify detection and forensic-readiness gaps, and mentor Incident Response / DFIR Specialists.

Requirements

• Strong hands-on knowledge of the incident response lifecycle, including investigation, containment, eradication, recovery and lessons learned.
• Experience leading complex security incidents and coordinating multiple technical teams during active response.
• Practical experience investigating endpoint, identity, server, cloud or network compromise using EDR/XDR, SIEM and relevant audit logs.
• Ability to reconstruct attacker activity, including initial access, credential abuse, persistence, privilege escalation, lateral movement, data access and exfiltration.
• Working knowledge of digital forensics, evidence preservation, forensic timelines and chain-of-custody principles.
• Experience designing and validating containment actions such as endpoint isolation, account and session revocation, credential rotation, indicator blocking, network restrictions and service isolation.
• Experience with Microsoft Entra ID / Active Directory incident investigation.
• Understanding of ransomware, malware, phishing/BEC, account takeover, cloud/SaaS compromise, data exfiltration and insider misuse scenarios.
• Strong investigation-focused understanding of Windows, Linux, identity and enterprise networking, plus the ability to document technical findings, timelines, evidence, assumptions and containment recommendations clearly.

Nice to have

• Hands-on experience with Cortex XDR, Elastic Security or equivalent enterprise platforms.
• Experience investigating AWS or other cloud environments and using forensic tools such as Velociraptor, KAPE, Volatility, Autopsy, Magnet, EnCase or FTK.
• Experience with ransomware, BEC, insider-threat or cloud-account-compromise cases.
• Experience developing incident response playbooks, containment procedures, tabletop exercises or cyber incident exercises.
• Experience working with Legal, Privacy, HR or regulators, or managing external DFIR and incident-response retainers.
• Python, PowerShell or other scripting experience; experience in fintech, payments, brokerage, trading, banking or another regulated environment; relevant certifications such as GCIH, GCFA, GCFE, GNFA, OSCP or CISSP.

Culture & Benefits

• Opportunity to work remotely from Europe.
• 20 paid vacation days and 10 paid sick leave days per year.
• Public holidays according to the approved company holiday list.
• Medical, professional education, language learning and wellness budgets.