Senior DFIR Incident Responder – Hands-On Forensics Lead

TechShack; España; Remote; EUR 60,000 - 90,000; Full time

Job summary

TechShack is seeking a hands-on Cyber Incident Response Analyst to lead end-to-end investigations for a European client base. You will be the primary responder when a breach occurs, guiding evidence collection, analysis, containment and closure while coordinating with legal, IT and leadership teams.

The role requires you to actively perform forensic work using EnCase, Magnet AXIOM, Cellebrite, Volatility or KAPE, and to communicate findings clearly through reports and executive summaries.

Qualifications

• Currently in a DFIR or incident response role, leading investigations end to end.
• Hands-on forensic tooling experience with EnCase, Magnet AXIOM, Cellebrite, Volatility or KAPE.
• SOC background with 24/7 monitoring, triage and escalation.
• Exposure to threat hunting and EDR-based detection.
• Strong written reporting and verbal communication.
• Based in Europe and able to work on a B2B contract basis.

Responsibilities

• Lead incident response engagements from first notification through containment, recovery and lessons learned.
• Perform forensic analysis across endpoints, servers, memory, mobile devices, cloud and log sources.
• Acquire and handle evidence in a forensically sound way, maintaining chain of custody throughout.
• Use tools such as EnCase, Magnet AXIOM, Cellebrite, Volatility and KAPE to reconstruct attacker activity.
• Identify root cause, attacker TTPs, persistence and full scope of compromise.
• Threat hunt across customer environments using EDR telemetry and other data sources.
• Act as primary customer contact during live incidents, coordinating with legal, IT and compliance teams.
• Write clear investigation reports, executive summaries and remediation recommendations.
• Feed lessons learned back into detections, playbooks and IR procedures.

Skills

DFIR experience

Incident leadership

Forensic tooling

Stakeholder comms

Tools

EnCase

Magnet AXIOM

Cellebrite

Volatility

KAPE

Job description

TechShack is seeking a hands-on Cyber Incident Response Analyst to lead end-to-end investigations for a European client base. You will be the primary responder when a breach occurs, guiding evidence collection, analysis, containment and closure while coordinating with legal, IT and leadership teams.

The role requires you to actively perform forensic work using EnCase, Magnet AXIOM, Cellebrite, Volatility or KAPE, and to communicate findings clearly through reports and executive summaries.