Job ID: 3857Req ID: 842Location: United KingdomPay: GBP 95000 - 122000 (Salary)Posted: 2026-10-22Pay Type: Salary LevelBlue reduces risk and builds lasting resilience so organizations can innovate and advance their mission with confidence. As the world’s most analyst-recognized and largest pure-play managed security services provider, LevelBlue elevates client outcomes that matter: stronger defense, faster response, and sustained business continuity. LevelBlue combines AI-powered security operations, advanced threat intelligence, and elite human expertise to provide the most comprehensive portfolio of strategic advisory, managed security, offensive security, and incident response services. We are seeking a highly skilled and motivated Digital Forensics and Incident Response (DFIR) Manager to join our Global LevelBlue DFIR team. The ideal candidate will be more 'hands on' and responsible for leading the response to cybersecurity incidents and conducting digital forensic and incident response investigations end-to-end, from forensics to log analysis to report writing and presenting findings to clients clearly, confidently and defensibly. Hands on Digital Forensics & Incident Response: Lead and coordinate responses to cybersecurity incidents, including identification, containment, eradication, and recovery, managing engagements and workstreams with limited supervision. Conduct digital forensic science-based incident response investigations across a variety of digital devices, including servers and end user workstations, network systems and SaaS platforms that contain artifacts, logging, and data of investigative relevance. Collect, preserve, and analyze digital evidence in accordance with legal and regulatory requirements. Review and quality control deliverables produced by others. Collaboration and Communication: Act as a primary point of contact for clients during engagements, engaging independently with senior stakeholders including executives, IT, legal, compliance, insurers and external vendors. Present findings eloquently and defensibly, including under scrutiny from legal counsel and other parties. Internally, work closely with cross-functional teams including DFIR, Advisory, Testing, Threat Intelligence, MDR/MSS, and other LevelBlue services. Strong knowledge of digital forensics tools and techniques, including X-Ways, or similar forensic tooling. Strong understanding of network protocols, operating systems, and security technologies. Flexibility to support occasional travel and work outside standard business hours, including evenings and weekends, as required annually measured against a utilization target. Preferred Qualifications: Bachelor's or Master’s degree in Digital Forensics, Computer Science-focused or closely related field of study and expertise. Knowledge of scripting languages (e.g., Python, PowerShell) for automation and analysis. Knowledge of database formats for investigative and knowledge purposes. Knowledge of Azure, AWS, Oracle, and/or GCP as many modern threats traverse enterprise cloud platforms and knowledge of these platforms is a necessity for modern incident response engagements. At LevelBlue, you’re not just an employee—you’re part of a team making a real difference in the world of cybersecurity. At LevelBlue, we support flexible work and bring people together in person for key moments based on role, team, and business needs. LevelBlue is committed to a culture of respect, inclusion, and equal opportunity. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age, or any other status protected under applicable law. Please do not contact LevelBlue employees outside of the Talent Acquisition team. LevelBlue’s policy is to only accept resumes from agencies through its approved agency process and with a valid agreement in place. LI-SD1 #LI-Remote
