Senior Security Consultant – Incident Response
Confirmed on the employer's own hiring board on Oct 19, 2026. First seen by Alion on Oct 12, 2026.
Consultancy · Employee · Incident Response Consultant · Permanent · Full-time · Day
Do you want to be on the frontline when serious cyber incidents hit? You will lead complex investigations, guide customers through crises, and help shape our incident response services. You will join a highly skilled, collaborative team working with some of the most interesting and challenging cyber cases in the market.
Make a real impact in high-stakesincidents
You will be part of a small, expert Incident Response team handling everything from ransomware to targeted attacks across large, complex environments. You will work closely with customers, helping them stay calm, informedand in control during critical situations. You will collaborate with specialists across MDR, Intelligence and Consulting, learn from unique cases, and contribute to the development of tools, methodologiesand publications. At CSIS, we invest in your growth with dedicated training time, certifications, and peer learning - in an open, diverseand friendly culture built on “We commit, Wecare, Wesucceed together.”
When you join CSIS, you will get an interesting job in a company and an industry which is growing. You will get interesting challenges, that truly make a difference for our customers, and you will be able to take ownership for your work from start to finish. And you will not least get 130+ fantastic colleagues from all over the world. Besides that, you will get:
Flexible work from home arrangements
A competitive salary and personal benefit package
5 weeks holiday, plus 5 extra days off each year
Health Insurance, a pension, plus life and disability insurance
Healthy, varied lunches (incl. vegetarian and allergy options)
Home-baked goods, healthy snacks, coffee, tea and sodas in the office
Social activities and company events throughout the year
Paid mobile phone subscription and home internet
Your new job
In this client-facing role, you will lead major incident response engagements, support multiple customers, guide junior responders, and help clients strengthen their detection and response capabilities. You will work across diverse environments, industries, and technologies, making adaptability and strong communicationessential.
Your responsibilities will be:
Incident Response & Investigations (Client-Facing)
Lead complex and high-severity incident response engagements for customers across varied infrastructures (on-prem, cloud, hybrid).
Perform advanced forensic analysis across a variety of data sources (disk, memory, network, malware, cloud) and provide clients with clear, actionable findings.
Coordinate response activities with client technical teams, management, and legal/compliance contacts.
Develop accurateincident timelines, attribution assessments (where possible), and root-cause analyses.
Customer Communication & Advisory
Act as a trusted advisor to clients during and after incidents, providing guidance on containment, recovery, and long-term improvements.
Deliver polished, professional technical reports and executive summaries for clients.
Present findings to technical teams as well as to senior leadership and non-technical stakeholders.
Preparedness, Consulting & Continuous Improvement
Assistclients with incident readiness assessments, IR playbook creation, tabletop exercises, and contribute to CSIS’s MDR detection engineering.
Contribute to development of internal incident response methodologies, tooling, and best practices.
Mentor and guide junior team members during engagements and internal training.
About you
You are an experienced incident responder who remainscalm and structured under pressure. You enjoy working closely with customers, translating complex technical issues into clear business language, and you value collaboration and knowledge sharing. You are curious, proactiveand driven by making a real difference in the fight against cybercrime.
You bring most of the following:
Qualifications & Technical Expertise
Hands-on incident response experience, ideally in a consultancy, MSSP, DFIR, or CSIRT environment.
Proven track recordleading multi-client or multi-environment incident investigations.
Deep knowledge of Windows, Linux, and Active Directory security.
Strong knowledge of network protocols and security
Strong experience with SIEM and EDR tools, including detection logic, log correlation, and threat analysis. Hands-on experience with Sentinel/Defender and CrowdStrike a plus.
Advanced digital forensics experience (memory, disk, log, network).
Familiarity with evidence handling, chain-of-custody standards, and forensic reporting.
Strong understanding of attack techniques and threat actor behaviours (MITRE ATT&CK).
Experience in cloud investigations (Azure/AWS/GCP logs, identity, telemetry).
Consultancy-Specific Requirements
Ability to manage multiple parallel client engagements and prioritize effectively.
Excellent client-facing communication: confident, calm, and credible during crises.
Strong written documentation skills for both highly technical and non-technical readers.
Ability to scope engagements, set expectations, and represent the company professionally.
Regulatory & Governance Knowledge
Familiarity with European cybersecurity requirements, especially NIS2, GDPR breach handling, and relevant ISO standards.
Ability to advise clients on improving governance, detection maturity, and incident readiness.
Preferred Skills
Danish speaker - English only can be accomodated.
Threat hunting experience or development of hunting hypotheses.
Scripting/automation (Python, PowerShell, Bash).
Experience in red team/purple team activities or adversary emulation.
Experience providing IR training or running tabletop exercises.
Relevant Certifications
GIAC: GCIH, GCIA, GCFA, GCFE, GPEN, GNFA.
OSCP, CISSP, CISM, or cloud security certs (Azure/AWS/GCP).
Equivalent real-world experience also highly consideredand appriciated.
Personal Competencies
Professional, customer-oriented communication style.
Ability to remain composed and decisive under pressure.
Strong analytical mindset with attention to detail.
Leadership qualities and ability to mentor junior responders.
Curiosity and passion for threat research, attacker behaviour, and continuous learning.
This is a 24/7/365 function - flexibility, out-of-hours work, on-call coverage and occasional travel is required.
Other conditions
Security Clearance: As you may work with some of our public sector customers, a Security Clearance may be required.
Relocation: The position isbased out of our offices in Denmark, with some flexibility of remote working.Relocation can also be offered to Denmark if relevant