RemoteLeaf Logo
Log in Sign up

Incident Response & DFIR Lead

2 weeks, 6 days ago
Europe
Full-time
Lead
Security Analyst
Cybersecurity
Active Directory AWS Linux Network Security PowerShell Python SIEM
Apply Now
JustMarkets

JustMarkets

JustMarkets is a leading online trading platform that offers a wide range of financial instruments including Forex, CFDs, Gold, and Oil. With low spreads, high leverage up to 1:3000, and fast execution, JustMarkets provides a next-level trading experie...

Capital Markets
1-10
View All Jobs 63

Description

  • Lead incident response, containment, eradication, recovery, and forensic coordination for confirmed security incidents.
  • Act as Incident Commander for major security incidents and assign investigation, containment, and recovery responsibilities.
  • Coordinate investigations across endpoints, servers, identities, cloud platforms, SaaS environments, and network telemetry.
  • Direct forensic collection and analysis to determine attack paths, scope, persistence, and impact.
  • Coordinate containment and recovery actions with IAM, IT, Platform, Security Engineering, Product, and other technical teams.
  • Maintain incident timelines, evidence logs, decision records, action tracking, and evidence-handling standards.
  • Develop and maintain incident playbooks, forensic checklists, and containment procedures.
  • Lead post-incident reviews, root-cause analysis, remediation tracking, and incident-readiness exercises.
  • Identify detection and forensic-readiness gaps and translate findings into recommendations for security control owners.
  • Mentor Incident Response and DFIR Specialists and coordinate with external forensic providers when needed.

Requirements

  • Strong hands-on knowledge of the full incident response lifecycle, including investigation, containment, eradication, recovery, and lessons learned.
  • Experience leading complex security incidents and coordinating multiple technical teams during active response.
  • Practical experience investigating endpoint, identity, server, cloud, or network compromises using EDR/XDR, SIEM, and audit logs.
  • Ability to reconstruct attacker activity, including initial access, credential abuse, persistence, privilege escalation, lateral movement, data access, and exfiltration.
  • Working knowledge of digital forensics, evidence preservation, forensic timelines, and chain-of-custody principles.
  • Experience designing and validating containment actions such as endpoint isolation, credential rotation, indicator blocking, and service isolation.
  • Experience investigating Microsoft Entra ID and Active Directory incidents.
  • Understanding of ransomware, malware, phishing/BEC, account takeover, cloud/SaaS compromise, data exfiltration, and insider misuse.
  • Strong investigation-focused knowledge of Windows, Linux, identity systems, and enterprise networking.
  • Preferred: Experience with Cortex XDR, Elastic Security, AWS, forensic tools, scripting, incident exercises, regulated environments, or external DFIR providers.
  • Preferred: Relevant certifications such as GCIH, GCFA, GCFE, GNFA, OSCP, CISSP, or equivalent.

Benefits

  • 20 paid vacation days per year.
  • 10 paid sick leave days per year.
  • Medical budget.
  • Remote work opportunity.
  • Professional education budget.
  • Language learning budget.
  • Wellness budget for gym membership, sports gear, and related expenses.
  • Public holidays according to the company-approved holiday list.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Everbridge

Senior Information Security Internal Auditor

Everbridge 1K-5K Internet Software & Services

Everbridge is seeking a fully remote Senior Information Security Internal Auditor to manage security audit and compliance activities supporting its critical event management technology for enterprise and government customers.

United States Full-time Senior Security Analyst
$118k-$158k
CI/CD DevSecOps Terraform
1 day, 22 hours ago
Coalition

Senior Security Analyst - Germany

Coalition 251-1K Insurance

Coalition is seeking a Senior Security Analyst in Germany to assess cyber risk, investigate incidents and claims, and turn technical findings into customer guidance and improvements to insurance products and internal security processes.

Germany Full-time Senior Security Analyst
Cybersecurity HIPAA Network Security Penetration Testing TCP/IP
1 day, 23 hours ago
N-iX

Cyber Security Administrator

N-iX 1K-5K Internet Software & Services

N-iX is seeking a Junior Cybersecurity Administrator to support its global software development organization by maintaining and improving information security processes.

Ukraine Full-time Junior Security Analyst
Cybersecurity DNS Linux macOS SIEM TCP/IP
1 day, 23 hours ago
DoorDash

Senior Security Risk Analyst, GRC

DoorDash 10K-50K Air Freight & Logistics

DoorDash is hiring a Security Risk Specialist on its Global Governance, Risk and Compliance team to manage security risk assessments, treatment plans, reporting, exceptions, and proactive control improvement across DoorDash, Wolt, and Deliveroo.

United States Full-time Mid Level Security Analyst
$133k-$195k
4 days, 22 hours ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers