Incident Responder

Incident Responder / DFIR Consultant

Location: Gloucester or London - Hybrid / Flexible

Salary: £60,000-£80,000 DOE

Type: Permanent

I'm working with a growing cyber security consultancy and MSSP looking for an Incident Responder / DFIR Consultant to join its specialist security team.

Key Responsibilities

• Investigate and respond to incidents across endpoint, identity, network and cloud environments.
• Conduct digital forensic investigations, including evidence collection and analysis.
• Coordinate containment, eradication and recovery activities.
• Develop incident response plans, playbooks and support tabletop exercises.
• Communicate investigation findings and recommendations directly to customers.

What We're Looking For

• Hands-on incident response experience across endpoint, identity, network or cloud environments.
• Practical digital forensics knowledge, particularly Windows forensics, evidence collection and analysis.
• Experience investigating incidents using EDR/XDR and SIEM platforms.
• Understanding of incident containment, eradication and recovery.
• Strong communication skills and confidence working with customers.
• Eligibility for UK SC clearance.

Technologies: Velociraptor, KAPE, Timesketch, Volatility, PowerShell, SentinelOne, Microsoft Defender XDR and Microsoft Sentinel.

Experience with some of these tools is beneficial, but not all are required.

Exposure to incident response planning, tabletop exercises, MSSP environments or OT/ICS security would be advantageous, although training and development are available.

The role includes an incident response on-call rota and occasional customer travel.

You don't need to be an established Senior Incident Responder. Strong SOC or DFIR professionals ready for greater responsibility are encouraged to apply.