{"id":2332515,"url":"https://alion.io/job/csis-security-group-senior-security-consultant-incident-response","title":"Senior Security Consultant – Incident Response","company":{"id":55381,"name":"CSIS Security Group","domain":"csis.com","url":"https://alion.io/company/csis-security-group","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Easycruit","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Frederiksberg, Denmark"],"countries":["DK"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":81000,"max_usd":187000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"GCP","optional":false},{"name":"GDPR","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"Bash","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Red Teaming","optional":true}],"status":"live","first_seen_at":"2026-10-12T09:23:18Z","employer_posted_date":"2026-10-12","last_verified_at":"2026-10-29T13:20:16Z","board_verified":true,"closed_at":null,"days_open":17,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":17},"description":"Consultancy · Employee · Incident Response Consultant · Permanent · Full-time · Day\nDo you want to be on the frontline when serious cyber incidents hit? You will lead complex investigations, guide customers through crises, and help shape our incident response services. You will join a highly skilled, collaborative team working with some of the most interesting and challenging cyber cases in the market.\nMake a real impact in high-stakesincidents\nYou will be part of a small, expert Incident Response team handling everything from ransomware to targeted attacks across large, complex environments. You will work closely with customers, helping them stay calm, informedand in control during critical situations. You will collaborate with specialists across MDR, Intelligence and Consulting, learn from unique cases, and contribute to the development of tools, methodologiesand publications. At CSIS, we invest in your growth with dedicated training time, certifications, and peer learning - in an open, diverseand friendly culture built on “We commit, Wecare, Wesucceed together.”\nWhen you join CSIS, you will get an interesting job in a company and an industry which is growing. You will get interesting challenges, that truly make a difference for our customers, and you will be able to take ownership for your work from start to finish. And you will not least get 130+ fantastic colleagues from all over the world. Besides that, you will get:\nFlexible work from home arrangements\n\nA competitive salary and personal benefit package\n\n5 weeks holiday, plus 5 extra days off each year\n\nHealth Insurance, a pension, plus life and disability insurance\n\nHealthy, varied lunches (incl. vegetarian and allergy options)\n\nHome-baked goods, healthy snacks, coffee, tea and sodas in the office\n\nSocial activities and company events throughout the year\n\nPaid mobile phone subscription and home internet\n\nYour new job\nIn this client-facing role, you will lead major incident response engagements, support multiple customers, guide junior responders, and help clients strengthen their detection and response capabilities. You will work across diverse environments, industries, and technologies, making adaptability and strong communicationessential.\nYour responsibilities will be:\nIncident Response & Investigations (Client-Facing)\n\nLead complex and high-severity incident response engagements for customers across varied infrastructures (on-prem, cloud, hybrid).\n\nPerform advanced forensic analysis across a variety of data sources (disk, memory, network, malware, cloud) and provide clients with clear, actionable findings.\n\nCoordinate response activities with client technical teams, management, and legal/compliance contacts.\n\nDevelop accurateincident timelines, attribution assessments (where possible), and root-cause analyses.\n\nCustomer Communication & Advisory\n\nAct as a trusted advisor to clients during and after incidents, providing guidance on containment, recovery, and long-term improvements.\n\nDeliver polished, professional technical reports and executive summaries for clients.\n\nPresent findings to technical teams as well as to senior leadership and non-technical stakeholders.\n\nPreparedness, Consulting & Continuous Improvement\n\nAssistclients with incident readiness assessments, IR playbook creation, tabletop exercises, and contribute to CSIS’s MDR detection engineering.\n\nContribute to development of internal incident response methodologies, tooling, and best practices.\n\nMentor and guide junior team members during engagements and internal training.\n\nAbout you\nYou are an experienced incident responder who remainscalm and structured under pressure. You enjoy working closely with customers, translating complex technical issues into clear business language, and you value collaboration and knowledge sharing. You are curious, proactiveand driven by making a real difference in the fight against cybercrime.\nYou bring most of the following:\nQualifications & Technical Expertise\nHands-on incident response experience, ideally in a consultancy, MSSP, DFIR, or CSIRT environment.\n\nProven track recordleading multi-client or multi-environment incident investigations.\n\nDeep knowledge of Windows, Linux, and Active Directory security.\n\nStrong knowledge of network protocols and security\n\nStrong experience with SIEM and EDR tools, including detection logic, log correlation, and threat analysis. Hands-on experience with Sentinel/Defender and CrowdStrike a plus.\n\nAdvanced digital forensics experience (memory, disk, log, network).\n\nFamiliarity with evidence handling, chain-of-custody standards, and forensic reporting.\n\nStrong understanding of attack techniques and threat actor behaviours (MITRE ATT&CK).\n\nExperience in cloud investigations (Azure/AWS/GCP logs, identity, telemetry).\n\nConsultancy-Specific Requirements\nAbility to manage multiple parallel client engagements and prioritize effectively.\n\nExcellent client-facing communication: confident, calm, and credible during crises.\n\nStrong written documentation skills for both highly technical and non-technical readers.\n\nAbility to scope engagements, set expectations, and represent the company professionally.\n\nRegulatory & Governance Knowledge\nFamiliarity with European cybersecurity requirements, especially NIS2, GDPR breach handling, and relevant ISO standards.\n\nAbility to advise clients on improving governance, detection maturity, and incident readiness.\n\nPreferred Skills\nDanish speaker - English only can be accomodated.\n\nThreat hunting experience or development of hunting hypotheses.\n\nScripting/automation (Python, PowerShell, Bash).\n\nExperience in red team/purple team activities or adversary emulation.\n\nExperience providing IR training or running tabletop exercises.\n\nRelevant Certifications\nGIAC: GCIH, GCIA, GCFA, GCFE, GPEN, GNFA.\n\nOSCP, CISSP, CISM, or cloud security certs (Azure/AWS/GCP).\n\nEquivalent real-world experience also highly consideredand appriciated.\n\nPersonal Competencies\nProfessional, customer-oriented communication style.\n\nAbility to remain composed and decisive under pressure.\n\nStrong analytical mindset with attention to detail.\n\nLeadership qualities and ability to mentor junior responders.\n\nCuriosity and passion for threat research, attacker behaviour, and continuous learning.\n\nThis is a 24/7/365 function - flexibility, out-of-hours work, on-call coverage and occasional travel is required.\nOther conditions\nSecurity Clearance: As you may work with some of our public sector customers, a Security Clearance may be required.\n\nRelocation: The position isbased out of our offices in Denmark, with some flexibility of remote working.Relocation can also be offered to Denmark if relevant","description_format":"text","description_chars":6693,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"Danish","level":"All levels","optional":true},{"language":"English","level":"All levels","optional":true}]},"benefits":["Company events","Continuous learning","Flexible schedule","Health insurance"],"hiring_locations":[{"name":"Denmark","iso":"DK","kind":"country"}],"hiring_excludes":[],"relocation_offered":true,"industries":["Incident Response","Cybersecurity","Threat Intelligence","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-12T09:23:18Z"}],"visa":[],"liveness":{"score":76,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.84,"p_room":0.9,"age_days":16,"expected_fill_days":36,"reasons":["conf:1","velocity","win:mid"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/csis-security-group-senior-security-consultant-incident-response","json_url":"https://alion.io/job/csis-security-group-senior-security-consultant-incident-response.json","meta":{"generated_at":"2026-10-29T16:26:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":24554,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":55381},"rest":"https://alion.io/mcp/rest/get_company?id=55381"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcsis-security-group-senior-security-consultant-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcsis-security-group-senior-security-consultant-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcsis-security-group-senior-security-consultant-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/csis-security-group-senior-security-consultant-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcsis-security-group-senior-security-consultant-incident-response"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2332515}},{"tool":"search_jobs","arguments":{"company":"csis.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2332515},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}