Incident Responder Lead, Baobab

• Professional working proficiency in German and English to lead client and international partner discussions, explain technical decisions and provide written updates
• Typically 3+ years of relevant experience in incident response, recovery, infrastructure or technical project delivery, including coordinating complex recovery work
• Strong understanding of practical restoration, gained through delivering or supervising recovery in SMEs or comparable environments. You can assess plans, challenge assumptions and judge whether recovery checks are sufficient
• Experience managing an incident, major outage or recovery project: defining scope, coordinating specialists and providers, tracking actions and dependencies, and escalating delivery risks
• Technical knowledge of backup and restore workflows and system dependencies, sufficient to review specialist recommendations and explain tradeoffs to clients
• Experience using SIEM, EDR and forensic tools, such as Windows Defender for Business, Splunk, CrowdStrike, Velociraptor, X-Ways, KAPE, Hayabusa, SOF-ELK or OpenRelik. These are examples; experience with comparable tools is equally relevant
• Experience writing incident or root-cause reports that explain evidence, findings, limitations and remediation clearly. You can take responsibility for the final report from the outset
• Clear communication, sound judgement about when to seek specialist help, and the ability to keep clients and colleagues aligned under pressure
• Practical experience applying AI tools to technical work, such as agentic workflows or information extraction, and assessing their reliability. Bring curiosity, openness to feedback and the ability to guide adoption

Desirable

• Lead incidents from initial assessment to closure. Establish scope, agree priorities, assign responsibilities and adjust the response as new evidence emerges
• Coordinate investigation and recovery. Bring responders, recovery specialists and client IT providers together around a clear plan, managing dependencies and resolving blockers
• Work across client infrastructure, including Windows, Active Directory, Microsoft 365, virtualization and backups. Bring in specialists where needed; expertise in every platform is not expected
• Guide clients through difficult decisions. Explain findings, recovery options and tradeoffs in plain language, keeping technical teams and business stakeholders informed
• Oversee safe restoration. Review recovery plans, challenge assumptions about backups and system dependencies, and ensure the checks supporting a return to service are documented
• Own the final report. Review and approve incident reports, ensuring conclusions, limitations and recommendations are clear and supported by evidence
• Coach responders, review their work and turn lessons learned into better recovery runbooks
• Lead the adoption of cutting-edge AI tools across incident response. Turn promising approaches into practical investigation, recovery and automation workflows, coach the team in their use, and validate results while protecting incident data