{"id":1479519,"url":"https://alion.io/job/eye-security-manager-incident-response","title":"Lead Incident Response","company":{"id":38891,"name":"Eye Security","domain":"eye.security","url":"https://alion.io/company/eye-research","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":92,"open_postings":6,"ghost_share":0,"stale_share":0.333,"repost_share":0,"time_to_fill_p50_days":45,"computed_at":"2026-10-05T05:45:15Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["The Hague, Netherlands","Berlin, Germany"],"countries":["NL","DE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":69000,"max_usd":175000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":504},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Commander.js","optional":false},{"name":"GDPR","optional":true},{"name":"ISO 27001","optional":true},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true}],"status":"live","first_seen_at":"2026-09-29T14:42:02Z","employer_posted_date":"2026-09-29","last_verified_at":"2026-10-06T01:01:14Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"About this role\nWe are looking for an Incident Response Lead to join our Security Operations department.\nYou will lead the people who own our most serious cases end to end - coordinating ransomware and business email compromise investigations, doing the forensic work, and being the person on the phone when a client needs a straight answer under real pressure.\nYour first responsibility is people, not just process. You’re a first-line manager distinct from a senior individual contributor, with direct accountability for the performance and development of your team - while carrying enough hands-on DFIR credibility to run the most complex case yourself, or take over one mid-flight, when the situation demands it.\nWhat you will do\nLead, coach, and develop the Incident Response team: regular one-to-ones, feedback, and performance/development conversations aligned with Eye’s career framework\n\nLead by doing: manage the caseload and the people, but personally take point on the most complex or highest-profile incidents when needed\n\nOwn end-to-end incident response service quality: case intake and coordination, technical execution, client communication, and closure/reporting\n\nOwn delivery KPIs (time-to-containment, case-report quality and timeliness, client satisfaction on incident cases) and step in to unblock the team or personally lead a case when targets are at risk\n\nManage on-call and case-lead rostering and workload across the team, prioritising by severity and client exposure\n\nAct as the senior escalation point and, when needed, incident commander for major incidents - large ransomware, multi-entity BEC, or cases with legal/regulatory exposure\n\nOwn quality assurance for incident reporting: set the reporting standard and run structured peer review of case reports before they reach the client\n\nOwn and scale automation across the function’s casework (evidence collection, timeline building, reporting), partnering with engineering where it makes sense\n\nDrive continuous improvement of IR playbooks, tooling, and process as case volume grows; keep runbooks and SOPs accurate and actually used\n\nRepresent Incident Response in cross-functional discussions with SOC, Prevention, Product, Customer Success, and Legal where relevant\n\nWhat you will need\nTechnical: 6+ years of hands-on incident response / digital forensics experience with deep, current knowledge of DFIR methodology, EDR platforms, cloud security, and attacker TTPs; able to personally run a complex case, not just sign off on one\n\nLeadership: composure and sound judgement under real pressure, often with incomplete information, during live incidents; strong incident-report writing and a sharp eye for reviewing others’ reports; clear, calm, authoritative communication with clients and internal stakeholders during a crisis\n\nPeople management: proven experience leading or supervising a technical team through high-pressure, time-critical work, with a genuine interest in coaching people and helping them grow; first-line management experience or a strong informal leadership track record\n\nFluent English; Dutch (C2) required for client-facing work\n\nNice-to-have\nBackground in a CERT, CSIRT, MDR, or DFIR-focused environment\n\nExperience handling cases with legal or regulatory exposure\n\nScripting/automation experience applied to investigation workflows\n\nFamiliarity with compliance frameworks relevant to SMEs (NIS2, ISO 27001, GDPR)\n\nAbout Eye Security\nEye Security provides cybersecurity with embedded cyber insurance solutions for organisations across Europe. Headquartered in the Netherlands, we combine 24/7 detection and response with hands-on incident response to keep SMEs protected, and we’re growing internationally. When a client’s worst day happens, this is the team that shows up.","description_format":"text","description_chars":3781,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"Dutch","level":"Proficiency (C2)","optional":false},{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Germany","iso":"DE","kind":"country"},{"name":"Netherlands","iso":"NL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Managed Security"],"lifecycle":[{"event":"open","at":"2026-09-29T20:11:28Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":5,"expected_fill_days":45,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-10-05T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/eye-security-manager-incident-response","json_url":"https://alion.io/job/eye-security-manager-incident-response.json","meta":{"generated_at":"2026-10-06T02:56:27Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":4416,"day_limit":5000,"remaining_today":584,"minute_limit":60,"resets_at":"2026-10-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":38891},"rest":"https://alion.io/mcp/rest/get_company?id=38891"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Feye-security-manager-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Feye-security-manager-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Feye-security-manager-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/eye-security-manager-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Feye-security-manager-incident-response"}]}