{"id":2939143,"url":"https://alion.io/job/conscia-incident-response-analyst-incident-manager","title":"Incident Response Analyst & Incident Manager","company":{"id":55387,"name":"Conscia","domain":"conscia.com","url":"https://alion.io/company/conscia-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"HiBob","truth_index":{"grade":"B","score":75,"open_postings":10,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":37,"computed_at":"2026-10-29T05:49:05Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Denmark"],"countries":["DK"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":80000,"max_usd":186000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"GCP","optional":false},{"name":"Incident Management","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SentinelOne","optional":false},{"name":"VMWare","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-20T14:07:25Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-10-29T21:59:20Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":9},"description":"Join Conscia's CSIRT and combine digital investigation with the responsibility for guiding customers safely through the incidentCyberattacks rarely strike at a convenient time. When they do, our customers need overview, calm and answers about what has actually happened. Would you like to be there when we help them through the difficult hours - and learn from some of Denmark's most skilled specialists in the field? Then you might be our new Incident Response Analyst and Incident Manager.\nWe are strengthening our CSIRT (Cyber Security Incident Response Team) and are looking for a colleague who can both dig into the digital evidence and take responsibility for the process, the documentation and the dialogue with the customer. You do not need a long career behind you - but you do need the right mindset, a solid technical understanding, a sense of structure and the drive to grow into the role quickly. With us, you get real responsibility, close sparring with experienced colleagues and the opportunity to develop faster than you would in a traditional security role.\nYour role\nYou will be part of our CSIRT and work side by side with experienced analysts and consultants when our customers are hit by security incidents. The position covers two roles: as Lead Analyst, you structure and lead the technical investigation, and as Incident Manager, you coordinate the engagement and ensure structure, overview and alignment with the customer. During active incidents, you will as a rule be responsible for only one of these roles, but the role may vary from incident to incident depending on who you are on call with.\nLead Analyst\nAs Lead Analyst, you are responsible for structuring and guiding the technical investigation within the agreed scope of the incident. This means that you:\nSupport technical triage.\nIdentify the relevant investigation approaches.\nMaintain the investigation plan.\nCoordinate the analytical direction.\nSupport the prioritisation of technical response activities.\nYou support the Incident Manager by providing the technical findings, investigation status, recommendations and forensic input required for decision-making, customer communication and reporting.You provide the technical leadership required to maintain investigation quality, scope control, technical consistency and effective use of the assigned analysts and supporting specialists.\nIn the analytical work, you will among other things:\nTake part in incident response engagements: Contribute to handling security incidents at customers, from the initial data collection to closure and lessons learned.\nAnalyse digital evidence: Examine logs, endpoint telemetry, system artefacts and other digital evidence to determine what the attacker has done.\nFind the cause: Contribute to identifying attack vectors, root cause and the extent of the compromise.\nDocument and report: Prepare technical notes, timelines and findings that form the basis of our incident reports.\nCommunicate technical findings: Explain what the investigation shows, clearly and precisely, to both specialists and decision-makers.\nDevelop the CSIRT: Contribute to improving our playbooks, tools and analysis methods.\nJoin the on-call rota: After an introduction period, become part of the team's on-call rota, so we can help customers whenever an incident occurs.\nIncident ManagerAs Incident Manager, you are responsible for coordinating an incident response engagement once the CSIRT has been activated. You establish and maintain the response structure for the incident, including:Customer alignment.\nThe agreed work scope.\nCoordination of priorities with the Lead Analyst.\nVisibility of planned effort and time consumption.\nCoordination of assigned responders and supporting resources.\nResource activation when additional capacity, specialist knowledge, operational support or escalation is required.\nYou are responsible for ensuring that customer authority, approval boundaries, work scope, planned effort and time consumption are understood - both before and during activities with customer impact.If personnel without CSIRT Foundation training are assigned to an Incident Response Team, you ensure that they understand the applicable incident response structure as well as the expectations regarding confidentiality, documentation and procedural boundaries.\nIn addition, you will among other things be responsible for:\nCustomer onboarding & readiness: Introducing new customers to Conscia's Incident Response process and ensuring clear, up-to-date process and procedure manuals.\nDocumentation & reporting: Preparing incident reports that describe the course of events, causes and concrete recommendations.\nStatus meetings & customer dialogue: Conducting quarterly status meetings and sharing relevant insights on improvements, trends and new threat landscapes.\nProcess development: Contributing to the continuous improvement and optimisation of our incident response processes.\nCooperation with authorities: Coordinating with the police and forensics specialists in connection with digital investigations and evidence collection.\nKnowledge sharing: Turning new knowledge and current threats into practical advice and learning for both customers and colleagues.\nWho are you?\nBoth roles carry real responsibility during active incidents, so we are looking for someone with solid, hands-on experience in incident response. You do not need to be senior, but you must have the experience needed to lead a technical investigation and to coordinate an engagement with confidence. We imagine that you:\nHave solid practical experience with incident response and digital forensics - for example from a CSIRT, a SOC or a consulting role - and have worked on real incidents from initial triage to closure and reporting.\nCan plan and drive a technical investigation: choose the relevant investigation approaches, set priorities, keep the work within the agreed scope and guide other analysts along the way.\nHave a strong technical understanding of Windows and/or Linux and of how an enterprise environment is built, including Active Directory, networking and logging.\nHave experience coordinating incidents or other time-critical work across several parties, and are comfortable aligning scope, priorities, effort and time consumption with the customer.\nAre used to writing incident reports and presenting findings and recommendations to both technical specialists and decision-makers.\nHave an analytical and structured approach and keep focus and overview when the pressure is high.\nSpeak and write English fluently. Danish is not a requirement.\nWant to take ownership of processes, documentation and customer relationships - not only of the technical analysis.\nIt is an advantage if you also have\nExperience with EDR tools such as Microsoft Defender, CrowdStrike or SentinelOne.\nKnowledge of Microsoft 365, Entra ID and Azure - and preferably AWS or Google Cloud.\nExperience with disk or memory analysis, log analysis or malware triage.\nScripting or development skills (e.g. Python or PowerShell).\nCertifications or hands-on training from e.g. SANS/GIAC, OffSec, Hack The Box, TryHackMe, CyberDefenders, Blue Team Labs or 13Cubed. Experience from CTFs, a home lab or your own projects counts too.\nExperience with incident management, incident coordination or emergency preparedness work.\nExperience with preparing processes, procedures or reports for management level.\nKnowledge of evidence preservation and cooperation with the police or other authorities.\nExperience from consulting or customer-facing roles.\nYour personal strengths\nCurious and quick to learn: You like to dig into things, ask questions and understand how and why attacks succeed.\nAnalytical and thorough: You can get an overview of complex situations and separate what matters from what does not.\nCalm under pressure: You maintain structure and overview in pressured situations and handle change calmly.\nStrong communicator: You can turn complex technical events into clear messages, recommendations and reports.\nStructured and responsible: You take responsibility for seeing agreements, processes and follow-up all the way through.\nTeam player: You thrive in an environment where people share knowledge, help each other and draw on each other's skills.\nCustomer-oriented: You want to help and create a sense of security for customers in critical situations.\nConscia offers\nYou will be part of a professionally strong and ambitious team, where attention to detail, collaboration and well-being are at the centre. Among other things, you get:\nA structured introduction and close sparring with experienced colleagues, so you are quickly equipped for the role.\nA versatile role that combines technical investigation with customer responsibility, and experience from many different types of incidents at customers across industries.\nOpportunities for continuous competence development, training and certifications within DFIR, incident response and incident management.\nThe opportunity to grow with the tasks and develop towards a senior role as you gain experience.\nA flexible setup with mutual trust and room for both deep work and teamwork.\nIn addition to a competitive salary package, we offer an attractive pension and health scheme, a lunch scheme and a modern office environment.Next steps\nIf you have questions or would like to know more about the position, you are welcome to contact the Manager of the Incident Response team, Peter Sindt, on +45 22 63 36 56.\nWe hold interviews on an ongoing basis, so feel free to send your CV today.\nAbout Conscia\nConscia is a leading European provider of IT security and business-critical IT infrastructure based on solutions from, among others, Cisco, Palo Alto, VMware, Microsoft Azure and a wide range of other technology partners. Conscia has a strong focus on advanced cybersecurity, including monitoring, detection and handling of security incidents, compliance, and protection of complex and regulated IT environments.\nThe ambition is to be the preferred partner for organisations with critical IT infrastructure throughout the entire lifecycle - from strategic advice and architecture design to implementation, operations and continuous optimisation.\nConscia A/S employs more than 1,500 people and is represented in Denmark, Sweden, Norway, Germany, the Netherlands, Belgium, the United Kingdom, Ireland, Finland and Slovenia.","description_format":"text","description_chars":10404,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Denmark","iso":"DK","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Artificial Intelligence","Information Technology","E-learning"],"lifecycle":[{"event":"open","at":"2026-10-20T16:52:59Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":8,"expected_fill_days":37,"reasons":["conf:1","stale_co","velocity","win:early"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/conscia-incident-response-analyst-incident-manager","json_url":"https://alion.io/job/conscia-incident-response-analyst-incident-manager.json","meta":{"generated_at":"2026-10-29T22:16:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":32913,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":55387},"rest":"https://alion.io/mcp/rest/get_company?id=55387"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fconscia-incident-response-analyst-incident-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fconscia-incident-response-analyst-incident-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fconscia-incident-response-analyst-incident-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/conscia-incident-response-analyst-incident-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fconscia-incident-response-analyst-incident-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2939143}},{"tool":"search_jobs","arguments":{"company":"conscia.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2939143},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}