Cyber Incident Response Consultant

Ubds-Group; Manchester; Hybrid; GBP 65,000 - 95,000; Full time

Benefits offered by this job

Private medical cover

Discretionary bonus

25 Days holiday + Birthday + work-ann.

EV salary sacrifice

Contributed Pension

Death in service

Job summary

UBDS Group is seeking an experienced Cyber Incident Response Consultant to join our SIOC, based in London or Manchester. You will lead and perform digital forensics, investigations and incident response for complex customer environments, focusing on Microsoft and AWS and working with SIEM/EDR tooling.

You will mentor junior staff, contribute to playbooks and runbooks, and help grow our managed services capability through evidence-based improvements and post-incident reviews.

Qualifications

• Hands-on experience in cyber incident response and DFIR.

Responsibilities

• Lead or support customer-facing cyber incident response engagements from investigation to containment, eradication, recovery and reporting.
• Investigate ransomware, malware, phishing, account compromise and unauthorised access.
• Conduct digital forensic investigations across endpoints, servers, cloud, and network infrastructure.
• Analyse logs, telemetry and IOC to define incident scope and root cause.
• Use EDR, SIEM and forensic tooling to reconstruct attack timelines.
• Advise on containment decisions and remediation priorities.
• Produce incident reports with findings, timelines and remediation recommendations.
• Present findings to technical teams, customers and senior stakeholders.
• Develop incident response playbooks and runbooks; contribute to exercises and improvements.

Skills

Incident response

DFIR

SOC/SIOC

EDR/SIEM

Digital forensics

Customer-facing

Mentoring

Education

Certifications e.g. CRIA/GCIH/GCFA/GCFE/SC-200

Tools

Velociraptor

KAPE

Autopsy

Volatility

Defender XDR/ Defender for Endpoint (Desirable)

Job description

At UBDS, we help organisations transform through cloud, cyber security, AI and digital innovation. As our Managed Services capability continues to grow, we're looking for an experienced Cyber Incident Response Consultant to join our Security and Infrastructure Operations Centre (SIOC), based in either London or Manchester.

This is a hands-on, customer-facing consultancy role focused on investigating, responding to and recovering from cyber security incidents across complex customer environments. You will support and lead incident response engagements, conduct digital forensic investigations and advise customers on strengthening their cyber resilience and incident response capabilities.

You will work primarily across Microsoft and AWS environments, alongside SIEM, EDR and digital forensic tooling.

What You'll Do

• Lead or support customer-facing cyber incident response engagements, from initial investigation through containment, eradication, recovery and reporting.
• Investigate security incidents including ransomware, malware, phishing, account compromise and unauthorised access.
• Conduct digital forensic investigations across endpoints, servers, cloud environments and network infrastructure.
• Analyse security logs, endpoint telemetry, forensic artefacts and indicators of compromise to establish incident scope and root cause.
• Use EDR, SIEM and forensic tooling to investigate suspicious activity and reconstruct attack timelines.
• Advise customers on containment decisions, remediation priorities and recovery approaches.
• Support eradication and recovery activities, validating remediation and identifying any remaining security risks.
• Collect, preserve and document digital evidence, following appropriate forensic procedures and chain-of-custody requirements.
• Produce professional incident investigation reports, including findings, timelines, root cause and remediation recommendations.
• Present investigation findings and recommendations to technical teams, customers and senior stakeholders.
• Support threat hunting, detection engineering and improvements to security monitoring capabilities.
• Develop and improve incident response playbooks, processes and procedures.
• Design and support cyber incident exercises, including tabletop scenarios, simulated incidents and response workshops.
• Facilitate or contribute to exercises, evaluating response effectiveness and producing post-exercise recommendations.
• Work closely with SIOC analysts, security engineers, cloud specialists and wider Managed Services colleagues during incidents.
• Provide technical guidance and mentoring to less experienced security professionals.

What We're Looking For

We're looking for someone with strong incident response experience, practical forensic investigation skills and the confidence to engage directly with customers.

• Experience working within Cyber Incident Response, DFIR, SOC/SIOC or a similar cyber security environment.
• Hands-on experience investigating and responding to cyber security incidents.
• Experience supporting or leading customer-facing incident response engagements.
• Strong experience with EDR tooling, SIEM platforms and security log analysis.
• Understanding of incident response processes, including containment, eradication, recovery and lessons learned.
• Practical knowledge of digital forensic techniques, including endpoint, memory, network or cloud forensics.
• Experience collecting and preserving digital evidence, with an understanding of chain-of-custody principles.
• Ability to analyse attacker activity, indicators of compromise and common attack techniques.
• Good understanding of Windows, Linux, networking and cloud security.
• Experience investigating security incidents within Microsoft and/or AWS environments.
• Experience producing technical investigation reports and presenting findings to customers.
• Strong analytical, investigative and problem‑solving skills.
• Excellent communication, stakeholder engagement and consultancy skills.

Desirable Experience

Experience across some of the following would be beneficial:

• Microsoft Defender XDR, Defender for Endpoint and Microsoft Sentinel.
• AWS security services, logging and incident investigation.
• Digital forensic tooling such as Velociraptor, KAPE, Autopsy, Volatility or equivalent.
• Malware analysis, reverse engineering or network forensics.
• Threat intelligence, threat hunting and MITRE ATT&CK.
• Experience supporting ransomware investigations and complex security incidents.
• Designing and facilitating cyber incident tabletop exercises.
• Developing realistic incident scenarios, injects and exercise objectives.
• Evaluating exercise performance and producing post‑exercise reports and recommendations.
• Red Team, penetration testing or adversary simulation experience.
• Python, PowerShell or scripting for investigation and automation.
• Experience delivering cyber security consultancy services to external customers.
• Experience working within Government, Defence or other regulated environments.

Desirable Qualifications

Relevant certifications or equivalent practical experience would be beneficial, including:

• CREST Registered Incident Analyst (CRIA) or equivalent.
• GIAC Certified Incident Handler (GCIH).
• GIAC Certified Forensic Analyst (GCFA).
• GIAC Certified Forensic Examiner (GCFE).
• Microsoft Security Operations Analyst Associate (SC-200).
• CompTIA CySA+, Security+ or equivalent.
• Relevant SANS, CREST or other DFIR training.

The Opportunity

Based in London or Manchester, you'll join our growing Managed Services capability, working alongside experienced cyber security, cloud and infrastructure professionals within our SIOC.

You’ll gain exposure to a broad range of customer environments, complex cyber investigations and digital forensic activities, while playing an important role in helping customers respond to and recover from security incidents.

You’ll also have the opportunity to help develop UBDS's DFIR and incident response consultancy capability, shaping investigation processes, improving customer response readiness and supporting the continued growth of our Managed Services offering.

Why people choose to grow their careers at UBDS Group

Professionals choose to grow their careers at UBDS Group for its reputation as a dynamic and forward‑thinking organisation that is deeply committed to both innovation and employee development. At UBDS Group, employees are given unique opportunities to work on cutting‑edge projects across a diverse range of industries, exposing them to new challenges and learning opportunities that are pivotal for professional growth. The Group’s culture emphasises continuous improvement, offering ample training programs, mentorship, and the chance to gain certifications that enhance their skills and marketability.

UBDS Group fosters a collaborative environment where creativity and innovation are encouraged, allowing employees to contribute ideas and solutions that have a tangible impact on the company and its clients. This combination of professional development, a culture of innovation, and the opportunity to make meaningful contributions makes UBDS Group an attractive place for those looking to advance their careers and be at the forefront of technological and operational excellence.

Employee Benefits

• Training – All team members are offered a number of options in terms of personal development, whether it is technical led, business acumen or methodologies. We want you to grow with us and to help us achieve more
• Private medical cover for you and your spouse/partner, offered via Vitality
• Discretionary bonus based on a blend of personal and company performance
• Holiday – You will receive 25 Days holiday, plus 1 day for Birthday and 1 day for your work anniversary in addition to UK bank holidays
• Electric Vehicle leasing with salary sacrifice
• Contributed Pension Scheme
• Death in service cover

About UBDS Group

At UBDS Group our mission is to support entrepreneurs who are setting new standards with technology solutions across cloud services, cybersecurity, data and AI, ensuring that every investment advances our commitment to innovation, making a difference, and creating impactful solutions for organisations and society.

Equal Opportunities

We are an equal opportunities employer and do not discriminate on the grounds of gender, sexual orientation, marital or civil partner status, pregnancy or maternity, gender reassignment, race, colour, nationality, ethnic or national origin, religion or belief, disability or age.