Incident response lead

Pay in the destination countries

Monthly, in US dollars. Each country is an Imora admission package — open one for that route's fees, language requirement and deadline.

What does the day look like?

Between 30% and 40% of the working time is spent on direct crisis analysis and forensics: inspecting memory dumps and disk images using Velociraptor, KAPE, EnCase, FTK Imager, and Volatility, querying host telemetry via CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne, and analyzing log streams in Splunk and Elastic SIEM. Another 35% to 45% goes to crisis coordination and regulatory reporting: leading incident war rooms, briefing external legal counsel and executive leadership, and compiling technical timelines to satisfy mandatory disclosure rules such as the EU NIS2 Directive 24-hour warning and GDPR 72-hour notice.

The remaining 20% to 25% is dedicated to preparedness and root-cause analysis reports, building containment scripts in Python and PowerShell, and running tabletop drills. The position has a nominal 40-hour office week but operates on an on-call escalation roster (typically 1 week in every 4 weeks). During major ransomware emergencies or critical network intrusions, active shifts can extend to 14 to 18 consecutive hours.

Where does this lead?