Find a job 
Featured Companies 
Featured Universities 
For Companies At a Glance
- Tasks: Lead digital forensics and incident response investigations across various environments.
- Company: Join a global team tackling cyber threats and protecting clients.
- Benefits: Remote work, competitive salary, and opportunities for professional growth.
- Other info: Dynamic role with exposure to cutting-edge technologies and industry certifications.
- Why this job: Make a real difference in cybersecurity by helping clients recover from incidents.
- Qualifications: 3-5 years in digital forensics or incident response; strong project management skills.
The predicted salary is between 60000 - 80000 £ per year.
You will work as part of a global DFIR team responding to incidents such as ransomware, business email compromise, insider threats, data breaches, and advanced intrusions—helping clients contain threats, understand impact, and recover with confidence.
Key Responsibilities
- Lead and support digital forensics and incident response investigations across Windows, macOS, Linux, cloud, SaaS, and identity environments.
- Perform acquisition and analysis across endpoints, servers, cloud, SaaS, identity, and network telemetry while maintaining defensible chain-of-custody.
- Identify attacker tradecraft, determine root cause, assess scope and data-at-risk, and support threat actor eviction.
- Communicate effectively with all project stakeholders, including clients, outside counsel, insurers, and internal teams.
- Support containment, eradication, and recovery activities in coordination with client security teams and restoration partners.
Required Experience & Skills
- 3–5 years of hands-on experience in digital forensics, incident response, or security operations.
- Experience working across modern environments (EDR/XDR, SIEM, cloud, SaaS, identity platforms).
- Possess excellent project-management skills, with ability to communicate complex technical findings clearly to non-technical stakeholders.
- Comfortable working under pressure during live incidents, including occasional after-hours response.
Nice to have:
- Industry certifications such as GCFA, GCFE, GCIH, or similar.
- Experience delivering incident readiness services, such as compromise assessments, IRP/playbook development, tabletops, and cyber range activities.
- Exposure to expert witness support or litigation-related investigations.
DFIR Manager, Cyber Risk in London employer: Kroll, LLC
Contact Detail:
Kroll, LLC Recruiting Team
StudySmarter Expert Advice 🤫
We think this is how you could land DFIR Manager, Cyber Risk in London
✨Tip Number 1
Network, network, network! Get out there and connect with folks in the DFIR space. Attend industry events, webinars, or even local meetups. The more people you know, the better your chances of landing that dream job.
✨Tip Number 2
Show off your skills! Create a portfolio showcasing your past incident response cases or any relevant projects. This will give potential employers a taste of what you can do and set you apart from the crowd.
✨Tip Number 3
Don’t just apply blindly! Tailor your approach for each role. Research the company and its culture, and make sure to highlight how your experience aligns with their needs. We want to see that you’re genuinely interested!
✨Tip Number 4
Finally, apply through our website! It’s the best way to ensure your application gets seen by the right people. Plus, we love seeing candidates who take that extra step to engage with us directly.
We think you need these skills to ace DFIR Manager, Cyber Risk in London
Some tips for your application 🫡
Tailor Your CV: Make sure your CV is tailored to the DFIR Manager role. Highlight your experience in digital forensics and incident response, especially any hands-on work with Windows, macOS, and cloud environments. We want to see how your skills match what we're looking for!
Showcase Your Communication Skills: Since you'll be communicating with various stakeholders, it's crucial to demonstrate your ability to explain complex technical concepts in simple terms. Use examples from your past experiences where you successfully communicated findings to non-technical audiences.
Highlight Relevant Certifications: If you've got industry certifications like GCFA, GCFE, or GCIH, make sure to mention them! They can really set you apart from other candidates. If you don’t have them yet, consider mentioning any ongoing studies or plans to obtain them.
Apply Through Our Website: We encourage you to apply through our website for a smoother application process. It helps us keep track of your application and ensures you don’t miss out on any important updates. Plus, it’s super easy!
How to prepare for a job interview at Kroll, LLC
✨Know Your Stuff
Make sure you brush up on your digital forensics and incident response knowledge. Be ready to discuss specific tools and techniques you've used in past roles, especially in environments like EDR/XDR, SIEM, and cloud platforms. This will show that you’re not just familiar with the concepts but have practical experience.
✨Communicate Clearly
Since you'll need to explain complex technical findings to non-technical stakeholders, practice how you would break down intricate details into simple terms. Think about examples from your past where you successfully communicated during a crisis or incident.
✨Show Your Project Management Skills
Be prepared to talk about your project management experience. Highlight any instances where you led a team through an incident response or digital forensics investigation. Use the STAR method (Situation, Task, Action, Result) to structure your answers.
✨Stay Calm Under Pressure
Given the nature of the role, it’s crucial to demonstrate your ability to work under pressure. Share experiences where you managed high-stress situations effectively, especially during live incidents. This will reassure them that you can handle the demands of the job.