📅 Aug 21
Lead the Critical Incident Response Team (CIRT) at Sophos, managing operations and people while ensuring high-quality execution of cybersecurity incident responses.
Lead Incident Response
🕒 21 days ago
📍 🇳🇱 The Hague - Hybrid🎙️ Leadership🧑🔬 Incident Response Analyst📢 🇬🇧 English Required📢 🇳🇱 Dutch Required💼 Full-Time
Incident ResponseDigital ForensicsDFIR MethodologyEDR Platforms
📜 Description
- Lead, coach, and develop the Incident Response team through regular one-to-ones, feedback, and performance conversations.
- Manage team caseloads and rostering, and personally lead complex or high-profile incidents when needed.
- Own end-to-end incident response quality, from case intake and technical execution through client communication and reporting.
- Track delivery KPIs, unblock the team, and take over cases when targets are at risk.
- Serve as the senior escalation point and incident commander for major incidents; set reporting standards and review case reports.
- Scale casework automation and improve playbooks, tools, and processes while representing Incident Response in cross-functional discussions.
🛠️ Requirements
- 6+ years of hands-on incident response or digital forensics experience, with current knowledge of DFIR methodology, EDR platforms, cloud security, and attacker TTPs.
- Able to personally lead complex investigations; strong incident-report writing and review skills.
- Composure, sound judgment, and clear, authoritative communication with clients and stakeholders during crises.
- Experience leading or supervising a technical team in high-pressure work, with a commitment to coaching and developing people.
- Fluent English and Dutch at C2 level required for client-facing work.
- Nice to have: CERT, CSIRT, MDR, or DFIR-focused experience; legal or regulatory case exposure; investigation workflow scripting or automation; familiarity with NIS2, ISO 27001, or GDPR.
Full job description
About this role
We are looking for an Incident Response Lead to join our Security Operations department.
You will lead the people who own our most serious cases end to end — coordinating ransomware and business email compromise investigations, doing the forensic work, and being the person on the phone when a client needs a straight answer under real pressure.
Your first responsibility is people, not just process. You’re a first-line manager distinct from a senior individual contributor, with direct accountability for the performance and development of your team — while carrying enough hands-on DFIR credibility to run the most complex case yourself, or take over one mid-flight, when the situation demands it.
What you will do
Lead, coach, and develop the Incident Response team: regular one-to-ones, feedback, and performance/development conversations aligned with Eye’s career framework
Lead by doing: manage the caseload and the people, but personally take point on the most complex or highest-profile incidents when needed
Own end-to-end incident response service quality: case intake and coordination, technical execution, client communication, and closure/reporting
Own delivery KPIs (time-to-containment, case-report quality and timeliness, client satisfaction on incident cases) and step in to unblock the team or personally lead a case when targets are at risk
Manage on-call and case-lead rostering and workload across the team, prioritising by severity and client exposure
Act as the senior escalation point and, when needed, incident commander for major incidents — large ransomware, multi-entity BEC, or cases with legal/regulatory exposure
Own quality assurance for incident reporting: set the reporting standard and run structured peer review of case reports before they reach the client
Own and scale automation across the function’s casework (evidence collection, timeline building, reporting), partnering with engineering where it makes sense
Drive continuous improvement of IR playbooks, tooling, and process as case volume grows; keep runbooks and SOPs accurate and actually used
Represent Incident Response in cross-functional discussions with SOC, Prevention, Product, Customer Success, and Legal where relevant
What you will need
Technical: 6+ years of hands-on incident response / digital forensics experience with deep, current knowledge of DFIR methodology, EDR platforms, cloud security, and attacker TTPs; able to personally run a complex case, not just sign off on one
Leadership: composure and sound judgement under real pressure, often with incomplete information, during live incidents; strong incident-report writing and a sharp eye for reviewing others’ reports; clear, calm, authoritative communication with clients and internal stakeholders during a crisis
People management: proven experience leading or supervising a technical team through high-pressure, time-critical work, with a genuine interest in coaching people and helping them grow; first-line management experience or a strong informal leadership track record
Fluent English; Dutch (C2) required for client-facing work
Nice-to-have
Background in a CERT, CSIRT, MDR, or DFIR-focused environment
Experience handling cases with legal or regulatory exposure
Scripting/automation experience applied to investigation workflows
Familiarity with compliance frameworks relevant to SMEs (NIS2, ISO 27001, GDPR)
About Eye Security
Eye Security provides cybersecurity with embedded cyber insurance solutions for organisations across Europe. Headquartered in the Netherlands, we combine 24/7 detection and response with hands-on incident response to keep SMEs protected, and we’re growing internationally. When a client’s worst day happens, this is the team that shows up.
Similar jobs
Search more Incident Response Analyst jobs📅 Jan 27
The Senior Manager, Incident Response will lead a team of consultants to enhance advisory services, oversee incident response operations, and mentor team members while ensuring high-quality service delivery.
📅 Sep 20
Join Arctic Wolf as a Manager, Incident Response, where you'll lead a team to redefine cybersecurity through strategic leadership and advanced technical expertise.
📅 Sep 20
As the Manager of Incident Response at Arctic Wolf, you will lead a team in delivering world-class cybersecurity incident response services while driving operational excellence and team development.
Manager, Security Incident Response
📅 Sep 1
1Password👥 10,000+ employees🏢 Computer And Network Security🤝 B2B
📅 Sep 1
As the Manager of Security Incident Response, you will lead a team focused on enhancing incident response through automation and strategic initiatives while managing high-pressure security incidents.