Cyber Security Analyst in London

• Incident Response Analyst | Outside IR35 | London Hybrid
• Urgent Requirement | Long-Term Contract Scope | Leading Microsoft Security Partner

Experis is supporting a leading Microsoft Security Partner delivering a major cyber security transformation programme for a global financial services organisation.

We are seeking experienced Incident Response Analysts with strong digital forensics expertise to join a highly technical security environment, investigating and responding to complex cyber threats across enterprise infrastructure, cloud, identity and endpoint environments.

This is a hands‑on incident response position requiring proven experience managing live security incidents from initial investigation through containment, eradication and recovery.

Location

London, 2 days onsite per week

Start

ASAP

Duration

Initial contract with long-term programme scope

The Role

You will be responsible for investigating and responding to sophisticated cyber security incidents, conducting forensic investigations, establishing the scope and impact of security compromises, and coordinating containment and remediation activities.

Key Responsibilities

• Lead hands‑on investigations into complex security incidents, including compromised accounts, malware infections, ransomware, suspicious endpoint activity and potential lateral movement.
• Conduct digital forensic investigations, collecting and analysing endpoint, identity, cloud and network evidence to identify attacker behaviour and establish incident timelines.
• Investigate security alerts and indicators of compromise using SIEM, EDR and XDR technologies.
• Perform root cause analysis, identify attack vectors and determine the full scope and impact of security incidents.
• Coordinate containment, eradication and recovery activities with infrastructure, cloud and security engineering teams.
• Conduct proactive threat hunting and map attacker techniques against MITRE ATT&CK.
• Preserve forensic evidence, maintain accurate investigation records and produce detailed incident reports.
• Work alongside security engineers and technical stakeholders to improve detection, response and remediation capabilities.
• Proven commercial experience in hands‑on cyber security incident response within complex enterprise environments.
• Demonstrable digital forensics experience, including practical collection, preservation and analysis of forensic evidence during security investigations.
• Direct involvement in investigating and containing real security incidents, rather than solely monitoring, triaging or escalating SOC alerts.
• Strong practical experience investigating threats using SIEM and EDR/XDR security technologies.
• Experience investigating compromised endpoints, identities, suspicious network activity, malware or lateral movement.
• Strong understanding of the complete incident response lifecycle, including investigation, containment, eradication, recovery and post‑incident analysis.
• Ability to analyse security telemetry, reconstruct attack timelines, identify indicators of compromise and establish the extent of an incident.
• Experience documenting technical investigations, communicating findings and supporting remediation activities.
• Microsoft Sentinel, Microsoft Defender XDR and Defender for Endpoint.
• Kusto Query Language (KQL), advanced log analysis and threat hunting.
• Digital forensic tools such as Velociraptor, FTK, En Case, Magnet AXIOM, Volatility or equivalent technologies.
• Experience responding to ransomware, business email compromise, credential theft and advanced persistent threats.
• Financial services, banking or other heavily regulated enterprise environments.
• DFIR consulting or major incident response experience.
• Who We're Looking For

We are particularly interested in experienced Incident Responders, DFIR Analysts, Digital Forensics Consultants, Cyber Defence Specialists and technically strong L3 SOC professionals who have taken direct ownership of complex security investigations.

This is not an entry‑level SOC monitoring role. Hands‑on digital forensics and real‑world incident response experience are essential.