Incident Responder - Dutch speaking (m/f/d)

• Execute containment and forensic investigation of ransomware, business email compromise and other incidents: preserve evidence, analyze host and identity logs, and develop findings with specialist guidance.

• Support systems restoration after cyber incidents: assess backups, rebuild servers and endpoints, resolve dependencies and validate services before returning them to use.

• Work with client IT teams and managed service providers across Windows, Active Directory, Microsoft 365, virtualization and backup environments.

• Document technical work and communicate progress, uncertainties and blockers, escalating risks to the lead.

• Put cutting-edge AI tools to work in investigations, recovery and automation. Experiment with new approaches, validate results and help shape how the team adopts them, while protecting incident data.

• Improve recovery checklists, scripts and playbooks by sharing lessons from casework.

Minimum requirements for the role

• Professional working proficiency in Dutch and English for client discussions, written updates and coordination with international response partners.

• 2+ years of hands-on experience in IT support, systems administration, recovery or incident response.

• Experience using SIEM, EDR and forensic tools, such as Windows Defender for Business, Splunk, CrowdStrike, Velociraptor, X-Ways, KAPE, Hayabusa, SOF-ELK or OpenRelik. (These are examples; experience with comparable tools is equally relevant.)

• Basic experience documenting technical work in tickets, change logs or recovery notes.

• Practical experience using AI tools for technical tasks, such as information extraction, log analysis or agentic workflows.

• Openness to coaching and feedback, and motivation to develop your security and investigation skills.

Languages

• Dutch - business fluent

• English - business fluent

Requirements that give you an edge

• Strong practical restoration experience, ideally with SMEs or small IT teams.

• Hands-on troubleshooting and backup or restore knowledge, with willingness to learn unfamiliar technologies.

• Familiarity with threat hunting and using threat intelligence to guide investigations, prioritize suspicious activity and assess indicators of compromise.