Digital Forensics and Incident Response, Senior Consultant DFIR

Role overview

Tasks and responsibilities

• Manage forensic and incident response consultancy covering data collections, investigations, analysis, and cybersecurity services.
• Support Cyber, Investigations, and Technical Consulting teams across regions.
• Lead engagements, deliver timely work products, and maintain defensible evidential standards.
• Remain on call for short-notice matters and deploy to support crises.
• Anticipate client needs, improve efficiency, and bring teams together through innovative solutions.
• Respond to enquiries, develop sales leads and proposals, and participate in business development and marketing.
• International travel may represent up to 25% of working time.

Essential knowledge and experience

• Proven experience investigating cyber incidents requiring forensic response.
• Understanding of emerging trends and response capabilities in the forensic cyber industry.
• Experience handling client crisis situations effectively.
• Extensive professional and technology experience in cyber risk consulting, forensic investigations, financial crime, or compliance.
• Computer forensics experience for cyber incident response and investigations.
• Knowledge of NPCC, NIST, SANS, evidence handling, computer systems, and forensic tools.
• Understanding of MITRE ATT&CK, the Cyber Kill Chain, network topology, and EDR solutions.
• Expertise with Microsoft and Linux infrastructure, networking, on-premise and cloud systems, Office 365, Azure, and AWS.
• Expertise in PowerShell, Bash, Python, SQL, and data wrangling for log analysis.
• Familiarity with EnCase, Nuix, Axiom, BlackBag, open-source tools, and commercial forensic tools.
• Experience with forensic collections, incident response, digital investigations, contemporaneous notes, and client deliverables.
• Experience managing client expectations, preparing project estimates and plans, and developing professional teams.

Qualifications and specialist skills

• Bachelor's degree required; postgraduate degree or other qualifications are a plus.
• Professional qualifications such as EnCE, GIAC, or CISSP are listed as qualifications for the role.
• Preferred knowledge includes broad programming and scripting skills and understanding of the EDRM.

Benefits and working arrangements

• The company offers a competitive compensation and benefits package and a discretionary global bonus scheme.
• Hybrid working arrangements are supported wherever possible, alongside flexible and remote working.