Cyber Incident Response Consultant

Control-Risks; Greater London; Hybrid; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Hybrid working

Discretionary bonus

Job summary

Control Risks in London is seeking a Cyber Incident Response Consultant to join the team and deliver cyber incident response projects for clients. You will work on high-profile incidents, including compromise assessments and ransomware investigations, applying expertise across infrastructure, web servers and cloud environments.

This role emphasizes developing tooling and automation, contributing to the Cyber Response practice, and coordinating with Threat Intelligence and Cyber Crisis

Qualifications

• Proven incident response experience within a security operations or incident response team.
• Technical degree or demonstrated knowledge of networks, software and hardware.
• Strong understanding of enterprise infrastructure, web servers and cloud environments.

Responsibilities

• Lead and assist on real-world cyber incidents including ransomware investigations.
• Conduct host, network, and cloud investigations using forensics and log analysis.
• Develop and refine investigative tooling and automation for delivery improvements.
• Provide clear client-facing reports and documentation.
• Support on call duty rota and client communication.

Skills

Incident response

Ransomware investigations

EDR tooling

Digital forensics

Cloud environments

Scripting

Automation

Threat intelligence collaboration

Client communication

On-call experience

Education

Technical degree

Tools

SIGMA rules

SNORT rules

YARA signatures

Job description

Thanks to continued growth, we are now looking for a Cyber Incident Response Consultant to join us in our London office. As the Cyber Incident Response Consultant you will be responsible for delivering Control Risks' Cyber Incident Response projects for clients. Working as part of a team on high-profile incidents, you will undertake compromise assessments and business email compromise investigations, as well as investigate and help lead the technical response to complex cases, including ransomware attacks. The role also contributes to developing the investigative toolsets and automation used by the practice. Reporting to an Associate Director of Cyber Response, you will work closely with the Cyber Crisis Management team. The successful candidate will have an incident response background; technical expertise spanning infrastructure, web servers and cloud environments; a deep understanding of current and emerging threat actors; and a genuine interest in developing tooling that improves the delivery of investigations. Please note that this role will require you to work at least three days per week from our London office on a hybrid basis.

Tasks and Responsibilities

Incident Response

• As part of the cyber incident response team leading and assisting with host, network, web server and cloud-based investigations into complex cyber incidents, including ransomware attacks.

• Investigate incidents affecting SaaS platforms and software development environments (e.g. source code repositories and CI/CD pipelines), drawing on an understanding of common development practices.

• Threat hunting and identification of attacker activity, using EDR and agent-led forensic tooling, to inform the investigation and containment activities

• Perform live compromise assessments for organisations who suspect live and ongoing system intrusion.

• Detect and hunt unknown live, dormant, and custom malware in memory across multiple systems in an enterprise environment.

• Contribute to the design and development of investigative toolsets and automation, and assist with commercialising the technology developed to ensure it is fit for purpose.

• Demonstrate an understanding of both existing and emerging threat actors, as well as experience identifying rapidly changing tools, tactics and procedures of attackers.

• Work with the Cyber Threat Intelligence team to identify where they could benefit from the technical information acquired during Cyber Response cases. Also identify and implement where threat intelligence can be leveraged through tooling and automation.

• Advise on the safe technical recovery of an organisations IT systems balancing the need to understand what has happened but speed up recovery.

Client Management

• Ensure tooling and automation developed is customer friendly to deploy and use. Be responsible for any customer queries that arise from the use of the technology and automation.

Reporting

• Provide situation reports and other significant case related material to the client, case lead, and team leadership.

• Provide documentation to the relevant consultants in sufficient time to allow review and feedback, before submitting to a client.

• Contribute to high quality client reports highlighting technical findings in a structured and defensible manner.

Supporting the growth of the Cyber Response practice

• Discuss and input into Control Risks’ cyber response methodologies and approaches whilst tailoring the approach in changing market conditions.

• This role has a requirement to join the team’s on call duty rota.

• Identifying potential new areas of growth and opportunity.

Essential

• Proven experience investigating complex cyber incidents, including ransomware attacks, as part of an incident response team

• Technical degree or demonstrated knowledge of common networks, software and hardware used in business environments

• Strong understanding of enterprise infrastructure, web servers and cloud environments (e.g. Microsoft Azure / Entra ID, AWS, Google Cloud), including how they are attacked and investigated

• Experience in conducting log analysis and digital forensics following a cyber incident

• Proven experience in responding to cyber-attacks

• Fluent in English (written and spoken)

• Excellent presentation skills

• Excellent analytical skills

• Scripting and or development experience

• Demonstrable investigative mindset and independent research of complex incidents and interest in developing investigative toolsets and automation to support and enhance our cyber incident response practice

Preferred Qualifications and specialist skills

• Strong understanding of MITRE ATT&CK techniques / sub-techniques. The ability to articulate TTPs to clients in non-technical terms.
• Experience in generating SIGMA rules for host detection, SNORT rules for network detection and YARA Signatures for file and memory artefact identification.
• General understanding of common SaaS platforms and software development practices (e.g. source control, CI/CD pipelines, APIs), sufficient to investigate incidents affecting these environments.

• Control Risks offers a competitively positioned compensation and benefits package that is transparent and summarised in the full job offer.
• We operate a discretionary global bonus scheme that incentivises, and rewards individuals based on company and individual performance.
• Control Risks supports hybrid working arrangements, wherever possible, that emphasise the value of in-person time together - in the office and with our clients - while continuing to support flexible and remote working.
• As an equal opportunities employer, we encourage suitably qualified applicants from a wide range of backgrounds to apply and join us and are fully committed to equal treatment, free from discrimination, of all candidates throughout our recruitment process.

If you require any reasonable adjustments to be made in order to participate fully in the interview process, please let us know and we will be happy to accommodate your needs.