The Role
You triage and investigate alerts across SIEM, EDR/XDR, identity, email, cloud and network platforms, leading or supporting investigations into phishing, malware, compromise and data loss. You coordinate containment with clients, run review meetings and carry out forensic analysis across host, network and cloud artefacts.
Skills & Experience
Requires hands-on DFIR, SOC or incident response experience, strong knowledge of Windows and Linux analysis, authentication logs and network traffic, plus familiarity with MITRE ATT&CK and NIST frameworks. Tools such as Sentinel, Defender XDR, Velociraptor, Volatility, EnCase, FTK or Wireshark, and certifications like GCIH, GCFA or SC-200 are advantageous.
Who It Suits
Suited to an experienced incident responder comfortable working directly with clients under pressure, who enjoys variety across different environments and wants exposure to the full incident lifecycle, from forensics through to detection engineering.
Incident Response / DFIR Analyst employer: Forensic Focus
Quorum Cyber is an exceptional employer located in Edinburgh, Scotland, offering a dynamic work culture that fosters collaboration and innovation in the field of cyber security. Employees benefit from structured career development opportunities and the chance to work with cutting-edge technologies in a fast-growing, award-winning managed security services provider. With a focus on employee growth and a supportive environment, Quorum Cyber stands out as a meaningful place for professionals looking to advance their careers in incident response.
