{"id":2939144,"url":"https://alion.io/job/conscia-incident-manager","title":"Incident Manager","company":{"id":55387,"name":"Conscia","domain":"conscia.com","url":"https://alion.io/company/conscia-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"HiBob","truth_index":{"grade":"B","score":80,"open_postings":11,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":19,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Denmark"],"countries":["DK"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":81000,"max_usd":189000,"period":"year","method":"role_country_seniority_unknown","sample_n":10},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Azure","optional":false},{"name":"GDPR","optional":false},{"name":"Incident Management","optional":false},{"name":"ITIL","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"VMWare","optional":false}],"status":"live","first_seen_at":"2026-10-20T14:02:17Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-10-23T06:01:25Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Join Conscia's CSIRT and take charge when our customers face their most critical momentsCyberattacks rarely strike at a convenient time. When they do, our customers need someone who brings calm, structure and direction - someone who keeps everyone aligned while the technical work moves forward. Would you like to be that person, and lead some of the most significant cyber incidents in the Nordics? Then you might be our new Incident Manager.\nOur Cybersecurity Incident Response Team (CSIRT) handles many of the largest cybersecurity incidents in Europe. The team consists of dedicated experts in digital forensics, advanced infrastructure, recovery and incident management, who work together to solve the most challenging situations. We have helped countless organisations recover from cyberattacks and get back to business with minimal impact.\nWe are now strengthening the team with a dedicated Incident Manager. In this role, your focus is not on the forensic analysis itself, but on leading the engagement: driving progress, aligning priorities, coordinating stakeholders and acting as the customer's trusted advisor from the first call until the incident is closed.\nYour role\nAs Incident Manager, you are responsible for coordinating incident response engagements once the CSIRT has been activated - from initial response through containment, forensic investigation and recovery to post-incident activities. You work closely with multidisciplinary teams of forensic investigators, recovery specialists, infrastructure experts, legal advisors and customer stakeholders, and you are the one who ensures that everyone is working towards the same goal.\nLeading the engagement\nYou establish and maintain the response structure for the incident, including:\nCustomer alignment and the agreed work scope.\nCoordination of priorities with the Lead Analyst.\nVisibility of planned effort and time consumption.\nCoordination of assigned responders and supporting resources.\nResource activation when additional capacity, specialist knowledge, operational support or escalation is required.\nYou ensure that customer authority, approval boundaries, work scope, planned effort and time consumption are understood - both before and during activities with customer impact. The Lead Analyst provides you with technical findings, investigation status and recommendations, which you translate into decisions, customer communication and reporting.If personnel without CSIRT Foundation training are assigned to an Incident Response Team, you ensure that they understand the applicable incident response structure as well as the expectations regarding confidentiality, documentation and procedural boundaries.\nKey responsibilities\nLead incident response engagements: Coordinate cybersecurity incidents from activation to closure and lessons learned, and drive recovery efforts to minimise business disruption and downtime.\nPrimary point of contact: Act as the customer's main contact during incidents and as a trusted advisor to IT management, executives and other stakeholders.\nCross-functional coordination: Coordinate technical and business specialists - internally at Conscia and with the customer's own teams and third parties.\nStatus meetings & crisis communication: Run status meetings and briefings during incidents, and keep decision-makers informed with clear, timely updates.\nDocumentation & reporting: Ensure incident documentation is kept up to date, and prepare incident reports that describe the course of events, causes and concrete recommendations.\nCooperation with authorities: Coordinate with the police and forensics specialists in connection with digital investigations and evidence collection.\nCustomer onboarding & readiness: Introduce new customers to Conscia's Incident Response process, ensure clear and up-to-date process and procedure manuals, and hold recurring status meetings sharing insights on improvements, trends and the threat landscape.\nResilience after the incident: Support customers in strengthening their resilience and preparedness once the incident is over.\nDevelop the CSIRT: Contribute to the continuous improvement of our incident response processes, playbooks and methodologies.\nJoin the on-call rota: After an introduction period, become part of the team's on-call rota, so we can help customers whenever an incident occurs.\nWho are you?\nWe believe you have a background in cybersecurity, IT operations, managed services, consulting, technical account management, service delivery, project coordination or a similar field. You enjoy working with both technical specialists and business stakeholders, bringing structure to challenging situations and helping teams prioritise their work towards a common goal. We imagine that you:\nHave experience leading major incidents, service disruptions or crisis situations - ideally in a time-critical setting with many parties involved.\nUnderstand how modern IT environments and services are built, operated and supported, including Active Directory, networking, cloud and logging - well enough to follow the technical work and ask the right questions.\nHave experience advising senior leadership and executive stakeholders, and can communicate clearly under pressure.\nAre comfortable aligning scope, priorities, effort and time consumption with the customer.\nBuild trusted relationships easily with both technical specialists and business stakeholders.\nHave strong problem-solving skills and a pragmatic mindset.\nAre used to writing reports and presenting findings and recommendations to decision-makers.\nHave professional proficiency in English, both written and spoken.\nIt is an advantage if you also have\nExperience within cybersecurity incident response, digital forensics, SOC operations or managed security services.\nProfessional proficiency in English.\nUnderstanding of compliance, regulatory, legal and information protection requirements, e.g. NIS2, GDPR and DORA.\nKnowledge of cyber risk management, business continuity, crisis management and resilience.\nExperience with cloud security and hybrid IT environments, e.g. Microsoft 365, Entra ID and Azure.\nKnowledge of evidence preservation and cooperation with the police or other authorities.\nExperience from consulting or customer-facing advisory roles.\nCertifications or training within incident management, crisis management, ITIL, project management or incident response (e.g. SANS/GIAC).\nYour personal strengths\nCalm under pressure: You maintain structure and overview in pressured situations and handle change calmly.\nNatural coordinator: You bring order to chaos, set priorities and make sure things actually move forward.\nStrong communicator: You turn complex technical events into clear messages, decisions and recommendations.\nTrusted advisor: You create a sense of security for customers in critical situations and earn the trust of executives and specialists alike.\nStructured and responsible: You take responsibility for seeing agreements, processes and follow-up all the way through.\nTeam player: You thrive in an environment where people share knowledge, help each other and draw on each other's skills.\nConscia offers\nYou will be part of a professionally strong and ambitious team, where attention to detail, collaboration and well-being are at the centre. Among other things, you get:\nA structured introduction and close sparring with experienced colleagues, so you are quickly equipped for the role.\nA central role in some of the largest and most complex cyber incidents in Europe, across many industries.\nOpportunities for continuous competence development, training and certifications within incident management, crisis management and incident response.\nThe opportunity to take on increasing responsibility as you develop your leadership, stakeholder management and crisis coordination capabilities.\nA flexible setup with mutual trust and room for both deep work and teamwork.\nIn addition to a competitive salary package, we offer an attractive pension and health scheme, a lunch scheme and a modern office environment.Due to the sensitivity of our assignments, we require EU citizenship.\nNext steps\nIf you have questions or would like to know more about the position, you are welcome to contact the Manager of the Incident Response team, Peter Sindt, on +45 22 63 36 56.\nWe hold interviews on an ongoing basis, so feel free to send your CV today.\nAbout Conscia\nConscia is a leading European service provider of IT security and business-critical IT infrastructure based on solutions from, among others, Cisco, Palo Alto, VMware, Microsoft Azure and a wide range of other technology partners. Conscia has a strong focus on advanced cybersecurity, including monitoring, detection and handling of security incidents, compliance, and protection of complex and regulated IT environments.\nThe ambition is to be the preferred partner for organisations with critical IT infrastructure throughout the entire lifecycle - from strategic advice and architecture design to implementation, operations and continuous optimisation.\nConscia A/S employs more than 1,500 people and is represented in Denmark, Sweden, Norway, Germany, the Netherlands, Belgium, the United Kingdom, Ireland, Finland and Slovenia.","description_format":"text","description_chars":9238,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Denmark","iso":"DK","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Artificial Intelligence","Information Technology","E-learning","Incident Response"],"lifecycle":[{"event":"open","at":"2026-10-20T16:52:59Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":2,"expected_fill_days":19,"reasons":["conf:4","stale_co","velocity","win:early"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/conscia-incident-manager","json_url":"https://alion.io/job/conscia-incident-manager.json","meta":{"generated_at":"2026-10-23T10:13:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15567,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":55387},"rest":"https://alion.io/mcp/rest/get_company?id=55387"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fconscia-incident-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fconscia-incident-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fconscia-incident-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/conscia-incident-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fconscia-incident-manager"}]}