Cyber Incident Manager

It all starts with the mission: NVISO is here to protect European society from potentially devastating cyber attacks. This means we offer cyber security services to private and governmental organizations to help them better prepare for prevent detect and respond to cyber security incidents. All of this is built on four fundamental values that define who we are: We are Proud We Break Barriers We Care and No BS!

As our Cyber Incident Manager you will lead NVISOs response to high-impact cyber incidents and act as the primary customer-facing decision-maker throughout the engagement. You will take ownership of the full incident lifecycle from initial triage and scoping through investigation containment eradication recovery and post-incident improvement. You bring structure to complex fast-moving situations by establishing the response model defining priorities and investigative questions coordinating technical and business workstreams and ensuring decisions and actions are clearly documented and followed through. Working closely with Incident Responders Digital Forensics specialists Threat Intelligence legal IT risk data protection communications and customer leadership you translate technical findings and business impact into clear practical recommendations for senior stakeholders. Your role is to keep the response focused coordinated and effective enabling the customer to make timely well-informed decisions while the technical team investigates and contains the incident.

Your responsibilities

• Act as Incident Lead during active engagements coordinating the technical response team and steering decisions on containment eradication recovery evidence preservation and business continuity.
• Assess incoming incidents determine their severity and potential business impact and ensure the right people expertise and escalation paths are activated quickly.
• Run customer and internal incident calls establish an effective war-room cadence and keep a clear incident timeline decision log action tracker and stakeholder map.
• Serve as the primary point of contact for customer leadership during incidents delivering concise factual and timely updates on the situation business impact decisions required response progress and next steps.
• Produce and quality-review high-quality incident deliverables including executive updates status reports incident reports root-cause analysis and actionable remediation roadmaps.
• Ensure the incident response follows the agreed response framework engagement scope evidence-handling requirements and applicable regulatory contractual and organisational obligations.
• Coordinate with legal privacy risk communications insurance and external specialists where required; ensure the customer has the information needed to make informed notification disclosure and recovery decisions.
• Support customers with regulatory incident reporting by identifying relevant facts timelines impact and evidence while leaving legal determinations and formal notification decisions to the appropriate customer and legal stakeholders.
• Balance technical urgency with operational realities: help customers make defensible risk-based decisions on isolation recovery restoration of critical services and communications.
• Manage and mentor incident response team members during engagements: delegate work effectively remove blockers maintain quality and protect team wellbeing during sustained high-pressure incidents.
• Coordinate third parties such as cloud providers managed service providers insurers outside counsel PR advisers and law enforcement where they are involved in the response.
• Maintain accurate incident documentation and ensure evidence key decisions customer actions and outstanding risks are traceable throughout the engagement.
• Lead or oversee post-incident reviews and lessons-learned sessions; turn findings into practical improvements to playbooks detection coverage response procedures recovery plans and customer readiness.
• Identify recurring incident patterns and systemic weaknesses and recommend pragmatic security enhancements to reduce the likelihood and impact of future incidents as part of structured lessons learned sessions
• Contribute to and continuously improve NVISOs incident-management methodology templates crisis communications approach escalation procedures and readiness services.
• Support incident readiness engagements such as tabletop exercises crisis simulations forensic readiness assessments response-plan reviews and executive briefings.
• Stay current on threat actor activity attacker TTPs major incident trends and relevant regulatory developments and use these insights to improve response decision-making and customer advice.

What we are looking for

• You hold citizenship in one of the 32 NATO member states;
• 5 years of relevant experience in cybersecurity incident response digital forensics crisis management IT service management or a comparable high-pressure operational role.
• Ability to explain technically complex matters for a wide variety of stakeholders.

Demonstrated experience leading or coordinating cyber incidents including triage investigation containment eradication recovery stakeholder communication and post-incident review.

Proven stakeholder-management skills: comfortable leading calls and communicating with technical teams IT leadership CISOs executives legal counsel privacy professionals risk teams and external providers during stressful situations.

• Strong coordination and leadership skills: able to organise parallel workstreams delegate effectively keep actions and their actioner moving resolve blockers and create an effective working rhythm during prolonged incidents.
• Customer-facing consulting maturity with the ability to build trust quickly challenge constructively and balance technical commercial legal and operational considerations.
• A continuous-improvement mindset: you are motivated to turn lessons learned into stronger playbooks readiness measures detection capabilities and response processes.
• Up-to-date knowledge of current cyber threats attacker tradecraft and the wider incident-response landscape.
• Language: Dutch and/or French and English at C1 proficiency for client-facing work across BE/NL/LUX.

Your availability

• We have an On-call rotation typically one week per month.
• Be prepared to operate outside standard business hours as part of an on-call rotation and during active incidents.

Travel

• Some limited travel within BE/NL/LUX/DE/AT/CH (1020%) for onsite response workshops and stakeholder meetings.

At NVISO we care. We are committed to offering you a highly competitive remuneration package including financial and non-financial components:

• A training budget of 10.000 and 10 days every two years
• Company car Belgian fuel card
• Working and learning from the best people in the European cyber security industry. We have multiple SANS Instructors working at NVISO our staff has presented at popular hacking conferences (BlackHat BruCON OWASP etc) and all of our technical staff can acquire deep technical security certifications (GSE GXPN GREM GCFA OSCP etc)
• An entrepreneurial and agile company where you will be stimulated and supported in driving new initiatives (either through internal innovation or by improving our service offering) without losing sight of having fun!
• Regular team-building and fun events throughout the year;
• Our commitment to coach and counsel you and help you grow; each employee receives a personal coach within the team whose role is to ensure your well-being and helps you grow in your career!
• Flexible working hours and home office possibilities
• Flex Reward Plan
• 32 holidays

IF YOURE INTERESTED PLEASE SEND US YOUR APPLICATION!

WERE LOOKING FORWARD TO MEETING YOU!

Disclaimer on the Use of AI Tools in the Application Process

Please be aware that the creation and submission of application documents (e.g. CV cover letter case studies etc.) using AI-powered tools is only permitted to a limited extent.

Our expectations:

• Application documents must authentically reflect your own qualifications personality and motivation.
• The use of AI for supportive purposes (e.g. spell-checking improving wording) is acceptable.
• Fully generated application documents created by AI without personal adaptation or review are not permitted.
• Under no circumstances may NVISO information data or documents be uploaded to or processed by external AI tools.

We reserve the right to exclude applications from the selection and interview process that are clearly created primarily or exclusively by AI and show no recognizable personal input.

The purpose of this policy is to ensure a fair and transparent recruitment process and to obtain an authentic impression of our applicants.