Incident Response Consultant

We're working with a rapidly growing cyber security business that is looking to appoint an experienced Incident Response Consultant to join its expanding Incident Response and Digital Forensics team.

This is an excellent opportunity to join an ambitious organisation at an exciting stage of growth, working on complex cyber incidents for a diverse portfolio of clients.

You'll play a key role in investigating, containing and remediating cyber security incidents, including ransomware attacks, network intrusions and sophisticated threat actor activity. You'll also work directly with clients, providing expert guidance throughout the incident response lifecycle.

Key Responsibilities

• Lead and support complex incident response and digital forensic investigations, identifying, containing and remediating cyber threats.
• Investigate security incidents across Windows, Linux, cloud and enterprise environments.
• Conduct forensic analysis of endpoints, memory, network traffic and security logs to identify malicious activity and determine the scope of compromise.
• Utilise EDR technologies such as CrowdStrike, SentinelOne, Carbon Black and Microsoft Defender.
• Leverage forensic tools including Magnet AXIOM, FTK, Volatility and X-Ways to support investigations.
• Work directly with clients during live incidents, providing technical guidance, regular updates and remediation recommendations.
• Produce detailed investigation reports outlining findings, root causes and recommendations for both technical and non-technical stakeholders.
• Collaborate with internal security teams to enhance incident response capabilities, processes and methodologies.
• Stay informed of emerging cyber threats, attacker techniques and the latest incident response technologies.

Experience & Skills Required

• Previous experience in Incident Response, Digital Forensics or DFIR, ideally within a consultancy or incident response services environment.
• Strong understanding of incident response methodologies, forensic investigation techniques and common attack vectors.
• Experience investigating incidents across enterprise environments, including AWS, Azure and Microsoft 365.
• Hands-on experience with EDR, SIEM and digital forensic investigation tools.
• Good understanding of networking, operating systems, security logs and threat actor techniques.
• Familiarity with scripting or command-line tools such as PowerShell, Python or Bash.
• Excellent analytical, problem-solving and communication skills.
• Ability to communicate complex technical findings clearly to clients and senior stakeholders.

Desirable Certifications:

GCFA, GCFE, GCIH, CISSP or equivalent.