Senior Incident Response Forensics Analyst – All Genders

This is a fully remote position, open to applicants in United Kingdom.

📋 Description

• Conduct forensic investigations for organizations impacted by targeted threats, organized crime, politically motivated groups, ransomware, and various other commodity threats.

• Execute host forensic analysis on Windows, Linux, and Mac OS platforms.

• Carry out network analysis utilizing firewall logs, NetFlow, and logs from intrusion detection/prevention tools.

• Assist in or perform forensic acquisition and analysis in Azure, AWS, and GCP environments.

• Employ relevant tools to contain and eliminate threat actors during live intrusion incidents.

• Conduct basic static and dynamic analysis of malicious binaries and scripts.

• Provide tactical recommendations for compromised client organizations.

• Communicate findings to executive-level stakeholders and detailed results both verbally and in writing.

• Present technical findings to support external legal counsel in comprehending potential regulatory implications.

• Clearly communicate investigation details and manage to de-escalate situations.

• Define the scope for new cases and lead update calls when required.

• Stay abreast of developments in DFIR and incorporate relevant advancements into processes and procedures.

• Collaborate with internal teams to publish blogs about threat actor tactics, techniques, procedures, and vulnerabilities.

• Mentor junior analysts in both technical and soft skills.

• Conduct audits and peer reviews of incident reports.

• Promote information sharing and collaboration.

• Participate in weekday escalation and weekend/holiday on-call schedules.

⛳️ Requirements

• A minimum of three years of professional experience in digital forensics and incident response or other comparable cybersecurity roles.

• Ability to respond to inquiries and work outside of normal business hours when necessary.

• In-depth knowledge of host-based forensics, network analysis, and data breach response.

• Advanced understanding of current attack vectors and trends in cybersecurity.

• Capability to identify indicators of compromise (IOC) from newly released exploits with minimal community documentation.

• Experience with incident response and forensic tools, including Magnet Axiom, EnCase, FTK, X-Ways, SIFT, and other open-source forensic tools.

• Familiarity with commercial Endpoint Detection and Response (EDR), network monitoring, and Security Information and Event Management (SIEM) tools.

• Preferred: Bachelor’s Degree in Information Security, Digital Forensics, Computer Science, or a related field.

• Preferred: Certifications such as GCFA, GCFE, ACE, EnCE, or similar training.

• Preferred: Previous consulting experience.

• Preferred: Experience presenting at industry conferences and events.

• Preferred: Previous experience developing scripts and tools for data analysis.

• Preferred: Background in malware analysis and reverse engineering.

• Availability to work weekday escalation and weekend/holiday on-call schedules.

• Background checks are mandatory.

• Authorization to handle software or technology regulated under applicable U.S. export control laws and regulations, if applicable.

🏝️ Benefits

• Equity for all employees.

• 28 days of annual leave, 8 bank holidays, and paid volunteer days off.

• Employer-matched pension plan.

• Training and career development programs.

• Comprehensive Employee Assistance Program (EAP) with mental health services.

• Extensive private benefits plan, including medical insurance, virtual GP, optical and dental cashback, life insurance (4x basic salary), and group income protection.

• Fertility support and paid parental leave.

• Family-forming benefits and enhanced maternity benefits.