Senior Consultant | Cybersecurity - Incident Response

We help clients solve complex cyber security challenges and advise some of the world’s biggest brands on their most sensitive cyber issues. Discretion and confidentiality are central to how we operate. Our leadership is supported by national security heritage, with discretion and judgement as key values. Our engagements are varied, often for clients in distress, and we prioritize responsiveness, agility and expert-driven impact. We operate as one global cybersecurity P&L and collaborate across the business such as Strategic Communications, Technology and Data Science. After extensive growth, we are building out our EMEA cybersecurity practice and are looking for individuals comfortable in a start‑up environment within a corporate setting.

What You’ll Do

• Perform a wide range of cybersecurity engagements in a fast‑paced, deadline‑sensitive environment; summarise results accurately and concisely in written reports for a sophisticated client base consisting of top‑tier law firms, financial institutions and corporations.
• Manage consultants on engagements which involve teams of investigative researchers; provide oral reports to clients, when appropriate.
• Assist leadership in developing strategies to expand the portfolio of services offered and improve the efficiency and consistency of service delivery.
• Maintain current knowledge of industry trends, threats, methodologies and core technologies to assimilate client needs and design appropriate technical solutions.
• Lead assessment of current threat identification techniques and develop new methodologies and frameworks.
• Conduct incident analysis, combining sound analytical skills with advanced knowledge of cybersecurity, digital forensics and incident response.
• Assess client cybersecurity postures against industry standard best practices and frameworks.
• Lead modification and enhancement of proposals.

This role requires travel to clients and FTI offices.

How You’ll Grow

We are committed to investing in your professional development through a range of programs focused on fostering leadership, growth and development opportunities. We promote continuous learning and individual skills development through on‑the‑job learning, self‑guided professional development courses and certifications. You’ll be assigned a dedicated coach who mentors, guides and supports you through regular coaching sessions and is an advocate for your professional growth. As you progress, we offer tailored programs for critical professional milestones to ensure you are prepared and empowered for your next role.

What You Will Need To Succeed

• Analytical ability – ability to identify red flags, validate sources and make judgement calls about the completeness and accuracy of open‑source information.
• Experience developing investigative plans and strategies for engagements and producing creative solutions to challenging research problems.
• Strategic planning and resourcefulness.

Basic Qualifications

• Bachelor’s degree or equivalent experience.
• Experience conducting digital forensics or incident response or a similar role.
• Specialised experience in cyber incident response and cyber incident management.
• Understanding of frameworks and standards such as PCI, HIPAA, GDPR, CCPA, NERC CIP, ISO, NIST, etc.
• Experience conducting cyber framework assessments or the ability to learn.
• Technical hands‑on experience capturing and analysing forensic images from different systems including Windows, Linux, OSX and smartphones.
• Experience using tools such as Volatility, FTK Imager, Cellbrite, WireShark, EnCase, Axiom, Splunk, ELK, etc.
• Experience documenting the technical details gathered from forensic analysis into incident reports for wider consumption.
• Experience using EDR tools such as SentinelOne, Carbon Black, etc.
• Knowledge of Chain of Custody procedures.
• Understanding of data‑loss / data‑theft prevention concepts and technologies.
• Threat modeling fundamentals.

Preferred Qualifications

• Certifications related to digital incident response, e.g., GCFE, GCFA, GREM, GNFA, or willingness to obtain them.
• Experience in online learning platforms such as HackTheBox, Blue Team labs, etc.
• Scripting skills in Python, Bash and PowerShell.

FTI Consulting is an equal opportunity employer and does not discriminate on the basis of race, color, national origin, ancestry, citizenship status, protected veteran status, religion, physical or mental disability, marital status, sex, sexual orientation, gender identity or expression, age, or any other basis protected by law, ordinance, or regulation.