Cyber Incident Response Consultant & DFIR Lead

UBDS Group; Manchester; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Training

Private medical cover

Discretionary bonus

25 Days holiday

Birthday + work anniversary day

EV leasing

Pension scheme

Death in service cover

Job summary

UBDS Group is seeking an experienced Cyber Incident Response Consultant to join our Security and Infrastructure Operations Centre, based in London or Manchester. You will lead and perform hands-on investigations, advise customers on containment and remediation, and contribute to playbooks and exercise design.

In this role you will work across Microsoft and AWS environments, leveraging EDR, SIEM and digital forensic tools to drive incident response engagements, report findings, and mentor junior

Qualifications

• Experience in Cyber Incident Response, DFIR, SOC/SIOC or similar cyber security environment.
• Hands-on experience investigating and responding to cyber security incidents.
• Experience supporting or leading customer-facing incident response engagements.
• Strong experience with EDR tooling, SIEM platforms and security log analysis.
• Understanding of incident response processes including containment, eradication, recovery and lessons learned.
• Practical knowledge of digital forensic techniques across endpoints, memory, network or cloud forensics.
• Experience collecting and preserving digital evidence with an understanding of chain-of-custody principles.
• Ability to analyse attacker activity, indicators of compromise and common attack techniques.
• Good understanding of Windows, Linux, networking and cloud security.
• Experience investigating security incidents within Microsoft and/or AWS environments.
• Experience producing technical investigation reports and presenting findings to customers.
• Strong analytical, investigative and problem-solving skills.
• Excellent communication, stakeholder engagement and consultancy skills.

Responsibilities

• Lead or support customer-facing cyber incident response engagements from initial investigation through containment, eradication, recovery and reporting.
• Investigate security incidents including ransomware, malware, phishing, account compromise and unauthorized access.
• Conduct digital forensic investigations across endpoints, servers, cloud environments and network infrastructure.
• Analyse security logs, endpoint telemetry and forensic artefacts to establish incident scope and root cause.
• Use EDR, SIEM and forensic tooling to investigate suspicious activity and reconstruct attack timelines.
• Advise customers on containment decisions, remediation priorities and recovery approaches.
• Support eradication and recovery activities, validating remediation and identifying remaining risks.
• Collect, preserve and document digital evidence following forensic procedures and chain-of-custody requirements.
• Produce professional incident investigation reports with findings, timelines and remediation recommendations.
• Present investigation findings to technical teams, customers and senior stakeholders.
• Support threat hunting, detection engineering and improvements to security monitoring capabilities.
• Develop and improve incident response playbooks, processes and procedures.
• Design and support cyber incident exercises, including tabletop scenarios and simulated incidents.
• Facilitate or contribute to exercises, evaluating response effectiveness and post-exercise recommendations.
• Work with SIOC analysts, security engineers and wider Managed Services colleagues during incidents.
• Provide technical guidance and mentoring to less experienced security professionals.

Skills

Incident response

DFIR

SOC/SIOC

EDR tooling

SIEM platforms

Digital forensics

Cloud security

Windows

Linux

Cloud environments

Tools

Velociraptor

KAPE

Autopsy

Volatility

Microsoft Defender XDR

Microsoft Sentinel

Job description

UBDS Group is seeking an experienced Cyber Incident Response Consultant to join our Security and Infrastructure Operations Centre, based in London or Manchester. You will lead and perform hands-on investigations, advise customers on containment and remediation, and contribute to playbooks and exercise design.

In this role you will work across Microsoft and AWS environments, leveraging EDR, SIEM and digital forensic tools to drive incident response engagements, report findings, and mentor junior