Apply to IT Security Incident Response Expert - September 2026

For on of our clients in the energy industry, we are looking for a freelance IT Security Incident Response Expert

Project name: Defending the Castle

Project description: “Defending the Castle” is the short-term and immediate phase of the client’s AI threat resilience response. The purpose is to buy time by increasing detection, response, containment and recovery readiness while a broader Phase 2 plan is prepared for the rest of the Business IT units.

Tasks:

Conceptual development and structured implementation of the immediate incident response workstream for “Defending the Castle”, focused on AI-augmented attacks that may progress at machine speed.
Creation of practical response playbooks and SOPs for identity compromise, cloud control-plane abuse, endpoint intrusion, lateral movement, ransomware-style disruption and data-impact scenarios.
Definition of decision points for containment, escalation, evidence preservation, communication, legal/regulatory handover and crisis coordination.
Provision of technical consultation and recommendations to SOC, threat intelligence, security monitoring, infrastructure, application, Azure, on-premise and resilience teams.
Establishment and technical definition of a repeatable operating model for response readiness, evidence collection, handover and post-incident improvement before end of Q1 2027.
Provision of technical consultation to enable fast, consistent and controlled response to AI-assisted cyber incidents across hybrid Azure and on-premise landscapes.
Predefinition and documentation of roles, triggers, containment options, and communication paths to optimize incident response workflows
Development of guidelines to facilitate responder action when critical thresholds are reached.
Conversion of lessons from exercises and response reviews into improved playbooks, SOPs and control requirements.
Technical preparation of scenario walkthroughs for validation by SOC, Cyber Defense, legal/compliance, cloud, infrastructure and resilience stakeholders.
Assessment of exercise results against time-to-triage, time-to-contain, decision latency and handover quality.
Usability testing of playbooks by responders who did not author them.
Creation of a Management-ready dashboard for readiness gaps, residual risks and agreed next actions.
Identification and technical gap analysis of existing processes (too slow, fragmented, undocumented or dependent on informal knowledge) to document optimization potential.
Transformation of risk discussion Transformation of risk evaluations into executable playbooks, technical control frameworks, test protocols, backlog items and management evidence.
Provision of a structured handover of a Phase 2 backlog and recommendations for the broader Business IT resilience plan after Q1 2027.
Creation of comprehensive documentation with all results regarding the above-mentioned tasks with subsequent handover to client for review and approval for further usage.

Required skills:

Minimum 8 years in incident response, cyber defense operations, crisis management, digital forensics or security operations leadership.
Hands-on experience responding to identity compromise, ransomware, cloud compromise, endpoint intrusion and lateral movement incidents.
Strong understanding of Microsoft security stack, Azure/Entra ID response actions, EDR isolation, forensic triage and evidence preservation.
Proven ability to coordinate cross-functional technical and management stakeholders during high-pressure situations.
Relevant certifications such as GCIH, GCFA, GNFA, CISSP, CISM, SC-200, AZ-500 or equivalent are beneficial

Start: ASAP
Duration: till end of March 2027
Capacity: 40h/week
Location: Remote