Lead Incident Response

We are looking for an Incident Response Lead to join our Security Operations department. You will lead the people who own our most serious cases end to end, coordinating ransomware and business email compromise investigations, doing the forensic work, and being the person on the phone when a client needs a straight answer under real pressure. You are a first-line manager distinct from a senior individual contributor, with direct accountability for the performance and development of your team, while carrying enough hands-on DFIR credibility to run the most complex case yourself or take over one mid-flight when needed. About Eye Security: Eye Security provides cybersecurity with embedded cyber insurance solutions for organisations across Europe. Headquartered in the Netherlands, it combines 24/7 detection and response with hands-on incident response to keep SMEs protected, and is growing internationally.

Responsibilities

Lead, coach, and develop the Incident Response team through regular one-to-ones, feedback, and performance/development conversations; Lead by doing: manage the caseload and people, and personally take point on the most complex or highest-profile incidents when needed; Own end-to-end incident response service quality, including case intake and coordination, technical execution, client communication, and closure/reporting; Own delivery KPIs (time-to-containment, case-report quality and timeliness, client satisfaction on incident cases) and step in to unblock the team or lead a case when targets are at risk; Manage on-call and case-lead rostering and workload across the team, prioritising by severity and client exposure; Act as senior escalation point and incident commander for major incidents; Own quality assurance for incident reporting, including structured peer review before reports reach the client; Own and scale automation across casework (evidence collection, timeline building, reporting), partnering with engineering where sensible; Drive continuous improvement of IR playbooks, tooling, and process; keep runbooks and SOPs accurate and used; Represent Incident Response in cross-functional discussions with SOC, Prevention, Product, Customer Success, and Legal

Requirements

6+ years of hands-on incident response / digital forensics experience with deep, current knowledge of DFIR methodology, EDR platforms, cloud security, and attacker TTPs; able to personally run a complex case, not just sign off on one; composure and sound judgement under real pressure, often with incomplete information, during live incidents; strong incident-report writing and a sharp eye for reviewing others' reports; clear, calm, authoritative communication with clients and internal stakeholders during a crisis; proven experience leading or supervising a technical team through high-pressure, time-critical work; genuine interest in coaching people and helping them grow; first-line management experience or a strong informal leadership track record; Fluent English; Dutch (C2) required for client-facing work

Nice to have

Background in a CERT, CSIRT, MDR, or DFIR-focused environment; Experience handling cases with legal or regulatory exposure; Scripting/automation experience applied to investigation workflows; Familiarity with compliance frameworks relevant to SMEs (NIS2, ISO 27001, GDPR)