Cyber Incident Response Analyst

TechShack; España; Remote; EUR 60,000 - 90,000; Full time

Job summary

TechShack is seeking a hands-on Cyber Incident Response Analyst to lead end-to-end investigations for a European client base. You will be the primary responder when a breach occurs, guiding evidence collection, analysis, containment and closure while coordinating with legal, IT and leadership teams.

The role requires you to actively perform forensic work using EnCase, Magnet AXIOM, Cellebrite, Volatility or KAPE, and to communicate findings clearly through reports and executive summaries.

Qualifications

• Currently in a DFIR or incident response role, leading investigations end to end.
• Hands-on forensic tooling experience with EnCase, Magnet AXIOM, Cellebrite, Volatility or KAPE.
• SOC background with 24/7 monitoring, triage and escalation.
• Exposure to threat hunting and EDR-based detection.
• Strong written reporting and verbal communication.
• Based in Europe and able to work on a B2B contract basis.

Responsibilities

• Lead incident response engagements from first notification through containment, recovery and lessons learned.
• Perform forensic analysis across endpoints, servers, memory, mobile devices, cloud and log sources.
• Acquire and handle evidence in a forensically sound way, maintaining chain of custody throughout.
• Use tools such as EnCase, Magnet AXIOM, Cellebrite, Volatility and KAPE to reconstruct attacker activity.
• Identify root cause, attacker TTPs, persistence and full scope of compromise.
• Threat hunt across customer environments using EDR telemetry and other data sources.
• Act as primary customer contact during live incidents, coordinating with legal, IT and compliance teams.
• Write clear investigation reports, executive summaries and remediation recommendations.
• Feed lessons learned back into detections, playbooks and IR procedures.

Skills

DFIR experience

Incident leadership

Forensic tooling

Stakeholder comms

Tools

EnCase

Magnet AXIOM

Cellebrite

Volatility

KAPE

Job description

We are hiring a hands‑on Cyber Incident Response Analyst for a specialist digital and cyber security services provider that is strengthening its Digital Forensics and Incident Response (DFIR) capability. When a customer is breached, this is the person who gets the call, takes control of the investigation and sees it through to closure. This is an initial 12 month B2B contract, open to candidates based in Europe.

ABOUT THE ROLE

You will lead investigations end to end: scoping the incident, acquiring and preserving evidence, carrying out host, memory, mobile and log forensics, establishing the timeline and root cause, and driving containment, eradication and recovery.

Alongside the technical work, you will be the customer's trusted point of contact while an incident is live, keeping legal, IT, compliance and leadership stakeholders informed and aligned, often under real time pressure.

Please note: this is a hands‑on investigator role. It is not a GRC, audit, policy, security architecture or pure SOC management position. You need to be working in DFIR or incident response today and leading forensic investigations yourself.

WHAT YOU WILL BE DOING

• - Leading incident response engagements from first notification through containment, recovery and lessons learned
• - Performing forensic analysis across endpoints, servers, memory, mobile devices, cloud and log sources
• - Acquiring and handling evidence in a forensically sound way, maintaining chain of custody throughout
• - Using tools such as EnCase, Magnet AXIOM, Cellebrite, Volatility and KAPE to reconstruct attacker activity
• - Identifying root cause, attacker TTPs, persistence and the full scope of compromise
• - Threat hunting across customer environments using EDR telemetry and other data sources
• - Acting as the primary customer contact during live incidents, coordinating with legal, IT and compliance teams
• - Writing clear investigation reports, executive summaries and remediation recommendations
• - Feeding lessons learned back into detections, playbooks and IR procedures

WHAT WE ARE LOOKING FOR

• - Currently in a DFIR or incident response role, leading investigations and forensic analysis end to end
• - Hands‑on forensic tooling experience, e.g. EnCase, Magnet AXIOM, Cellebrite, Volatility or KAPE
• - A SOC background covering 24/7 monitoring, triage and escalation
• - Exposure to threat hunting and EDR‑based detection
• - Strong written reporting and verbal communication
• - Based in Europe and able to work on a B2B contract basis

NICE TO HAVE

• - GIAC certification such as GCIH, GCFR or GCFA, or similar (GCFE, GNFA, GREM, EnCE, CHFI)
• - EDR platforms such as CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne or Carbon Black
• - SIEM experience, e.g. Microsoft Sentinel, Splunk, QRadar or Elastic
• - Cloud incident response across Azure, Microsoft 365 or AWS
• - Ransomware and business email compromise investigations
• - Malware triage and Python or PowerShell scripting
• - Consultancy or MSSP background

IS THIS ROLE FOR YOU?

This role will suit someone who has personally run real investigations and can stand in front of a customer mid‑incident and calmly explain what is happening and what comes next. If your experience is SOC triage and escalation without leading forensic investigations, or incident coordination and GRC rather than hands‑on analysis, this one is unlikely to be the right fit.