Defend (Services)

DFIR Consultant

We are committed to equal opportunities and diversity. We therefore welcome all applications - regardless of nationality, religion/worldview, ethnicity and social origin, age, and sexual orientation and identity.





Full time

Working time



The Job

Does that get you up in the morning?

  • Conduct digital forensic investigations and support operations in compliance with applicable laws and client policies as part of incident response projects
  • Resolve ad hoc programming issues using pragmatic approaches
  • Lead technical projects and initiatives, with various stakeholders, to derive necessary actions, assess risks and constraints
  • Resolve issues and support cross-organizational efforts
  • Make recommendations to overcome future technical obstacles
  • Help customers understand complicated, technical circumstances
  • Document investigation steps and retention, e.g., processes and procedures (collection, processing, and analysis)


What we’re looking for*

  • Completed relevant technical training with at least 5 years of SOC or Incident Response (DFIR) experience.
  • Experience with:
  • Windows and Linux forensics
  • File system and storage forensics
  • THOR log analysis
  • Current IR tools, e.g. ELK, Plaso, Timesketch, GRR, THOR
  • Linux (CLI) and scripting
  • Experience with Advanced Persistent Threats and their TTPs (especially lateral movement).
  • Support of Ransomware victims
  • Remediation consulting, planning & execution
  • Willingness to travel
  • German language skills on B2 level and English language skills on C1 level

*Courage to leave a gap: You don't meet our requirements completely? We are still looking forward to your application!

We would like to increase the number of women in areas where they are underrepresented and are therefore particularly happy to receive applications from women. BIPOCs and people from the LGBTQIA+ community as well as people with a migration background are also strongly encouraged to apply. Applications from severely disabled people will be given preferential consideration in the context of equal suitability.


Best Place to Work

  • Culture

    International team
    Buddy program
    Company events
    Close team atmosphere
    Culture of trust
    Openness and transparency

  • Modern Work Environment

    Trust-based flex time
    Remote work
    Part-time schedules
    Ergonomic office equipment

  • Feel good

    Fruit and vegetables
    Diverse selection of drinks
    Food allowance
    Health care
    Urban Sports Club membership
    Language courses with Babbel

  • Financials

    Market-competitive salary
    30 days of vacation
    Closed on 24 December and 31 December
    Continuing education and conferences
    Employer-funded pension
    Bike leasing
    Berlin public transport ticket fares