Incident Responder

Incident Responder / DFIR Consultant

Location: Gloucester or London - Hybrid / Flexible

Salary: £60,000-£80,000 DOE

Type: Permanent

I'm working with a growing cyber security consultancy and MSSP looking for an Incident Responder / DFIR Consultant to join its specialist security team.

You'll investigate and respond to security incidents across customer environments, working alongside experienced SOC, Threat Intelligence and Detection Engineering teams.

Key Responsibilities

Investigate and respond to incidents across endpoint, identity, network and cloud environments.
Conduct digital forensic investigations, including evidence collection and analysis.
Coordinate containment, eradication and recovery activities.
Develop incident response plans, playbooks and support tabletop exercises.
Communicate investigation findings and recommendations directly to customers.

What We're Looking For

Hands-on incident response experience across endpoint, identity, network or cloud environments.
Practical digital forensics knowledge, particularly Windows forensics, evidence collection and analysis.
Experience investigating incidents using EDR/XDR and SIEM platforms.
Understanding of incident containment, eradication and recovery.
Strong communication skills and confidence working with customers.
Eligibility for UK SC clearance.

Technologies: Velociraptor, KAPE, Timesketch, Volatility, PowerShell, SentinelOne, Microsoft Defender XDR and Microsoft Sentinel.

Experience with some of these tools is beneficial, but not all are required.

Exposure to incident response planning, tabletop exercises, MSSP environments or OT/ICS security would be advantageous, although training and development are available.

The role includes an incident response on-call rota and occasional customer travel.

You don't need to be an established Senior Incident Responder. Strong SOC or DFIR professionals ready for greater responsibility are encouraged to apply.

Interested? Get in touch for a confidential conversation
Only candidates based in UK and eligible to work in UK are allowed