Senior Incident Response Analyst

Join Conscia's CSIRT and lead the technical investigation when our customers need it most

Cyberattacks rarely happen at a convenient time. When they do, our customers need clarity, reassurance and answers about what has actually happened. We are therefore looking for an experienced Senior Incident Response Analyst who can take the lead on complex cases and help strengthen our CSIRT (Cyber Security Incident Response Team) capabilities in DFIR and digital investigations.

At Conscia, you will join a highly specialised team where technical depth, professional sparring and knowledge sharing are a natural part of everyday work. You will work on a wide range of incidents for customers across industries and of varying sizes, with opportunities both to delve deeply into the technical aspects and to influence how we approach incident response in the future.

Your role
As a Senior Incident Response Analyst, you will play a key role in our CSIRT. During active incidents you take the role of Lead Analyst: you structure and lead the technical investigation and work closely with the Incident Manager, who coordinates the engagement and the alignment with the customer. You combine technical digital investigation with clear communication and structured reporting, helping to create clarity in high-pressure situations.

Lead Analyst
As Lead Analyst, you are responsible for structuring and guiding the technical investigation within the agreed scope of the incident. This means that you:

• Support technical triage.
• Identify the relevant investigation approaches.
• Maintain the investigation plan.
• Coordinate the analytical direction.
• Support the prioritisation of technical response activities.

You support the Incident Manager by providing the technical findings, investigation status, recommendations and forensic input required for decision-making, customer communication and reporting.

You provide the technical leadership required to maintain investigation quality, scope control, technical consistency and effective use of the assigned analysts and supporting specialists.

In the analytical work, your responsibilities will include:

• Handle incidents: Lead and participate in incident response engagements and digital investigations for customers, from initial data collection through to closure and lessons learned.
• Investigate compromised environments: Identify attack vectors, root cause, initial access, lateral movement, persistence and any data exfiltration.
• Analyse digital evidence: Work with disk, memory and network forensics, as well as logs, endpoint telemetry and cloud artefacts, to reconstruct the attacker's actions.
• Advise and communicate: Present findings and recommendations clearly and precisely to both technical specialists and senior management, verbally and in written incident reports.
• Work with authorities and external parties: Coordinate with the police, insurers and other forensic specialists in connection with investigations and evidence preservation.
• Develop the CSIRT further: Contribute to the development of methods, playbooks, tools and best practices, and help ensure the continued development and maintenance of our technical forensics infrastructure. You will also ensure that employees working with digital forensics build a solid understanding of the infrastructure and associated tools, and help establish a consistent, structured and quality-assured approach to forensic work through documentation, knowledge sharing, professional sparring and mentoring.
• Join the on-call rota: Participate in the team's 24/7 on-call service so that we can support customers whenever an incident occurs.

Who are you?
As Lead Analyst, you set the technical direction of our investigations, so we are looking for an experienced profile who can lead from the front. We imagine that you:

• Have at least six years of experience in incident response, digital forensics, threat hunting or a similar field, gained in a CSIRT, SOC, consultancy or internal security function.
• Have hands-on experience of forensic analysis of Windows and/or Linux, as well as investigating logs, endpoint telemetry and system artefacts.
• Have experience of leading or taking a lead role in an investigation: you can plan the work, keep it within the agreed scope, and create structure and prioritise when time is limited and the situation is unclear.
• Are used to guiding other analysts and specialists and to maintaining quality and technical consistency across an investigation.
• Have experience with EDR tools and modern security technologies, such as Microsoft Defender, CrowdStrike, Palo Alto or SentinelOne.
• Understand how threat actors operate in enterprise environments, including ransomware, business email compromise and targeted attacks.
• Speak and write English fluently and can communicate complex technical matters clearly to audiences with widely differing levels of technical knowledge.

It would be an advantage if you also have

• DFIR certifications, for example from SANS/GIAC (GCFE, GCFA, GCIH, GNFA), OffSec or equivalent.
• Experience of investigations in cloud and identity environments such as Microsoft 365, Entra ID and Azure, and ideally AWS or Google Cloud.
• Experience with memory analysis, malware analysis and threat intelligence.
• Scripting or development skills, such as Python or PowerShell, for automating analysis and data collection.
• A background in consulting, customer-facing work, or collaboration with the police and public authorities.

Your personal strengths

• Analytical and thorough: You can quickly gain an overview of complex situations, identify patterns in large volumes of data and distinguish what matters from what does not.
• Calm under pressure: You maintain structure, perspective and sound judgement in high-pressure situations, including engagements that extend over days or weeks.
• Customer-focused communicator: You give customers confidence and are skilled at translating technical information into clear, action-oriented messages.
• Curious and passionate: You are passionate about cybersecurity, stay abreast of the threat landscape and put new knowledge into practice.
• A team player who takes ownership: You work independently and take responsibility, while thriving in an environment where knowledge is shared and colleagues draw on one another's expertise.

What Conscia offers
You will join a highly skilled and ambitious team where attention to quality, collaboration and well-being are central. You will benefit from:

• Exciting and challenging cases for a broad range of customers and industries.
• Highly skilled colleagues, professional sparring and an environment where sharing knowledge comes naturally.
• Opportunities for continuous professional development, training and certifications.
• A genuine influence on how we develop our CSIRT, methods and tools.
• A flexible working arrangement built on mutual trust, with room for both focused work and teamwork.

In addition to a competitive remuneration package, we offer an attractive pension and health scheme, a subsidised lunch programme and a modern office environment.

Next steps
If you have any questions or would like to learn more about the role, please contact the Manager of the Incident Response team, Peter Sindt, on +45 22 63 36 56.

We review applications and hold interviews on an ongoing basis, so please send us your CV today.

About Conscia
Conscia is a leading European provider of cybersecurity and business-critical IT infrastructure based on solutions from Cisco, Palo Alto, VMware and Microsoft Azure, among others, as well as a broad range of other technology partners. Conscia has a strong focus on advanced cybersecurity, including the monitoring, detection and handling of security incidents, compliance, and the protection of complex and regulated IT environments.

Our ambition is to be the preferred partner for organisations with critical IT infrastructure throughout its lifecycle, from strategic advice and architecture design to implementation, operations and continuous optimisation.

Conscia A/S employs more than 1,500 people and operates in Denmark, Sweden, Norway, Germany, the Netherlands, Belgium, the United Kingdom, Ireland, Finland and Slovenia.