CERT Incident Responder (Remote)

Description

As a CERT Incident Responder at Stoïk, you will own the full lifecycle of cyber incidents for our policyholders from initial triage to post-incident reporting. You will also serve as a technical advisor to our underwriting team and a critical support for our Customer Success Management team or our Sales team, helping translate complex security risk into business-level recommendations.

Responsibilities

• Lead incident response engagements (ransomware, data breaches, BEC) from containment through remediation

• Conduct forensic investigations using KAPE, Velociraptor, and EDR platforms (CrowdStrike Falcon, SentinelOne)

• Produce clear, client-facing incident reports for both technical and executive audiences

• Provide real-time crisis communication to clients during active incidents

• Support underwriters with technical risk assessments on prospects and renewals

• Contribute to internal runbooks, playbooks, and tooling improvements

• Participate in building tools for our SOC or CERT team

Required Qualifications

• 3+ years of experience in DFIR, or CERT roles

• Proven experience leading multiple ransomware incident responses end-to-end

• Hands-on proficiency with Velociraptor, KAPE, CrowdStrike Falcon, and/or SentinelOne

• Strong log analysis and network forensics skills

• Skilled in AI agents usage & tool buildings through AI

• Ability to communicate technical findings clearly to non-technical stakeholders

• Fluent in English and a native language (Dutch, German, Italian, Spanish, French..)

What We're Looking For

Beyond technical skills, we're looking for someone who takes ownership under pressure, communicates with clarity and confidence, and has the judgment to make fast decisions in high-stakes situations. You will regularly be the most knowledgeable person in the room during a crisis, and we need you to act like it.

Expected languages & locations

We're recruiting for the following native languages :

• German

• Italian (with fluent French or German)

The job position is fully remote based.