Digital Forensics and Incident Response, Senior Consultant DFIR

Role overview

Core responsibilities

• Lead digital forensics, incident response, data collection, investigation, analysis, and cybersecurity consultancy engagements.
• Provide high-quality, timely, defensible client deliverables that meet evidential standards where appropriate.
• Support Cyber, Investigations, and Technical Consulting teams across regions.
• Respond to short-notice matters, remain on call, and deploy to support crises.
• Promote technical consulting services through business development and marketing activities.

Engagement leadership

• Act as technical lead for engagements and provide quality-assured forensic incident management.
• Manage client expectations and provide relevant solutions throughout the project lifecycle.
• Prepare project estimates, plans, proposals, retention agreements, written analyses, reports, and presentations.
• Manage and develop a team of professionals through empowerment, coaching, and motivation.
• Travel internationally for up to 25% of working time.

Essential experience

• Proven computer forensics experience supporting cyber incident response and investigations.
• Knowledge of evidence handling, forensic procedures, computer systems, and forensic tools.
• Understanding of MITRE ATT&CK, the Cyber Kill Chain, network topology, and EDR solutions.
• Expertise across Microsoft and Linux systems, on-premise and cloud infrastructure, Office 365, Azure, and AWS.
• Expertise in PowerShell, Bash, Python, SQL, and data wrangling for log analysis.
• Experience conducting forensic collections, incident response, and digital investigations with detailed notes.
• Ability to manage client expectations and work effectively under pressure across competing demands.

Tools and qualifications

• Familiarity with EnCase, Nuix, Axiom, BlackBag, open-source tools, and commercial forensic tools.
• A bachelor's degree is required; postgraduate study or additional qualifications is a plus.
• Professional qualifications such as EnCE, GIAC CFA, or CISSP are advantageous.
• Understanding of the EDRM and broader programming or scripting skills are preferred.

Working arrangements

• Control Risks supports hybrid working arrangements wherever possible, including office and client time with flexible remote working.
• The role requires international travel of up to 25% of working time.

Compensation and benefits

• The company provides a competitive compensation and benefits package.
• A discretionary global bonus scheme rewards company and individual performance.