DFIR Analyst

Pen Test Partners is an innovative and dynamic organisation committed to providing a supportive environment where our people can not only thrive but actively shape our culture and direction.

With over 120 employees across penetration testing, consultancy, digital forensics, sales, and support functions, we pride ourselves on attracting talented individuals and giving them the environment to develop and perform at their best. From real-world incident response to cutting-edge research, we deliver meaningful, high-impact work for our clients.

We have ambitious plans and therefore are growing our team and seeking an

experienced DFIR Analyst to expand their skills and join our experienced team.

Overview:

We are seeking a Digital Forensics and Incident Response (DFIR) Analyst to join our growing team.

This role combines hands‑on technical incident response with client‑facing advisory work. You will support onboarding of incident response retainer clients, respond to live incidents, and perform compromise assessments across a wide range of environments. Depending on experience, you may lead investigations end‑to‑end and act as a trusted advisor to clients during high‑pressure incidents.

Core Responsibilities

Support and lead the onboarding of DFIR retainer clients, validating access, tooling, logging coverage, and incident response readiness.

Respond to live cyber incidents, including ransomware, business email compromise (BEC), account compromise, and cloud‑based attacks.

Perform compromise assessments across endpoint, cloud, and network data sources to identify evidence of attacker activity.

Conduct forensic acquisition and analysis across systems and environments, ensuring evidence is handled and documented to a defensible standard.

Build timelines and correlate artefacts across multiple data sources (e.g. endpoint telemetry, logs, identity platforms, cloud services).

Support and lead containment and eradication activities, including host isolation, credential resets, and validation of recovery actions.

Produce clear, structured reports covering investigation findings, timelines, root cause, and recommendations.

Define investigation strategy, hypotheses, and evidence collection plans, and take ownership of engagements end‑to‑end.

Client Advisory & Collaboration

Work closely with client technical teams during onboarding, investigations, and remediation.

Support clients during live incidents, helping them understand risks and make informed decisions under pressure.

Contribute to incident response readiness reviews, identifying gaps in logging, detection, and operational processes.

Translate technical findings into clear, actionable recommendations for both technical and non‑technical stakeholders.

lead client briefings and act as a trusted advisor throughout the incident lifecycle.

Team Contribution & Development

Contribute to the development and improvement of DFIR playbooks, SOPs, and investigation methodologies.

Support knowledge sharing through internal case reviews and documentation.

Required experience and skills

Proven experience (typically 5+ years) in incident response, SOC operations, cybersecurity consulting.

Ability to lead investigations and make decisions under pressure

Demonstrated ability to product high‑quality IR reports, documentation and playbooks for enterprises.

Deep understanding of modern threat actors, attack methodologies and incident response lifecycle

Experience across cloud based and on‑premise enterprise environments.

Ability to work independently, meeting deadlines, and drive deliverables with minimal supervision

Preferred qualifications and experience:

GCIH, GCFA, CISSP or equivalent certifications.

Prior participation in or leading of real‑world cyber incident response activities.

Familiarity with identity governance, EDR platforms, SIEM tooling and cloud security architecture

Strong background in system administration and networking.

Familiarity with threat intelligence sources and the ability to translate intelligence into actionable responses.

Proficiency in using forensic tools and methodologies.

Excellent communication skills with the ability to convey technical information to non‑technical stakeholders.

Strong problem‑solving and analytical skills.

What can you expect from us?

Competitive salary based on experience

Private Medical Insurance and Healthcare Benefit on completion of probation

Group personal pension

Financing available for training and conference attendance

EV lease salary sacrifice scheme on completion of probation

An environment where you can flourish, learn, and grow, as a person not just as an employee

You’ll be working from home, though some onsite travel to client sites (including

international) may be required. Although we are a remote working company, we pay

for our teams to meet regularly throughout the year holding local and company