Master's theses in the field of Incident Response

We - HvS-Consulting GmbH - are specialists in cyber security. We not only investigate cyber attacks, but also ensure that the attackers are out and stay out. Our clients include the "who's who" of the German economy and public institutions.

We currently offer the following master theses:

Automated live response analyses and triage data backups via EDR interfaces

Programming a tool / script for the automated creation of live response information and triage data Acquisition via the API interfaces of widely used endpoint detection and response products. After securely transferring the data to an analysis environment, initial analyses of the live response information are to be carried out in order to identify possible attacker activity at an early stage using known signatures.

Identification and visualisation of attacker tools, tactics and procedures (TTPs) for compromised Microsoft 365 identities

Implementation of a (partially) automated analysis of Microsoft Entra ID and Office 365 log data to identify malicious activity, as well as visualisation of attack techniques such as adding multi-factor devices, hiding or redirecting emails, retrieving large amounts of data via IMAP or mailbox sync, etc.

A proof of concept can be implemented in standard log analysis software such as Splunk or using a scripting language and corresponding libraries such as Python or Go. Part of the task will also be the generation of test data with the help of Microsoft 365 E5 Instant Sandboxes

What you should bring with you:

  • You have contact with a chair / professor in the field of IT security at your university who is interested in the topic
  • You have programming experience in languages such as Python, Go, etc.
  • Ability to grasp things quickly and work independently
  • The desire to work with a cool, young team
  • Good written and spoken German and English skills

Your benefits at HvS-Consulting

We don't just offer muesli bars and free drinks - that's standard these days. We also offer you attractive benefits on request.
Benefits Jobrad (1)
Lease your new bike or e-bike and have it subsidised by us. It's cheaper than buying it outright and good for your health.
Benefits Spenditcard
Receive up to 50 euros a month tax-free on your individual prepaid credit card for lunch, shopping or refuelling.
Benefits Altersvorsorge
Retirement provision
Look to the future with peace of mind with our company pension scheme. We will subsidise your desired amount by 15% and pay it directly into the pension scheme.
Benefits Kind
Kindergarten subsidy
To be able to work with peace of mind, it is important that your little family members are well looked after. We subsidise childcare costs for crèche or kindergarten.
Benefits Jobticket
We welcome sustainable mobility and ensure that you can not only get to your workplace cost-effectively, but also to any other place in Germany.
Benefits Wellness (1)
The EGYM Wellpass gives you access to numerous fitness and wellness programmes in your area. We subsidise your membership with 50 euros per month to help you maintain a healthy lifestyle in your everyday working life.

Convinced? Apply now!

Thank you for your interest in joining our team! We'd love to learn more about you, so please take a moment to fill out the form below. If you have any difficulties uploading your documents or if you have any questions, please feel free to email us at We look forward to receiving your application!

You can find out how we handle your data in our privacy policy.

Most frequently asked questions

Our office is located on the business campus in Garching, just outside Munich.

Why not downtown? Because Garching is perfect for us!

  • We have a direct underground connection, at peak times every 5 minutes.
  • The A9 and A99 motorways are only a 3-minute drive away.
  • The airport is just a 25-minute drive away.
  • The business campus offers a diverse selection of restaurants and lunch options.
  • There is an Edeka supermarket right next door for private daily or weekly shopping.
  • We have a modern office on 600 square metres on the 6th floor with a sensational view over Munich to the Alps.

With a 5-day week, you will receive 30 days' holiday from us. You can also take holiday with us during your probationary period by arrangement with your team leader, as we always try to make holiday requests possible.

You will receive your personalised onboarding plan. We will welcome you to our office in Garching for the first few days in your new job. Here you can not only soak up a bit of HvS DNA, but also get to know your new colleagues. You will receive a comprehensive IT and security briefing and will be able to jump straight into your first projects.

You will be "refuelled", but not to the point of overflowing, because we know how demanding the first few days in a new job are and try to divide all the new information into suitable morsels.

We are fundamentally a virtual company and remote working is of course part of a modern working environment. First and foremost, we work in a results-orientated and flexible way, sometimes from anywhere in the world.

However, real teams are formed after meetings, in the coffee kitchen or over lunch, which is why we also like to see you in the office.