Cyber Incident Response Lead

Trades Workforce Solutions; Greater London; Hybrid; GBP 80,000 - 100,000; Full time

Job summary

A leading cybersecurity recruitment firm is looking for a Cyber Incident Response Lead to enhance incident response capabilities across a major organization. This hands-on role requires a strong background in incident response and digital forensics, with responsibilities including leading investigations and performing both host and network forensics. Applicants must have SC eligibility and 5+ years of UK residency. The position is UK-wide, with one required trip to London each month.

Qualifications

• 5+ years of experience in relevant Cybersecurity roles.
• SC eligibility — must have lived in the UK for the last 5 years.
• Strong technical understanding of modern attacker TTPs and the MITRE ATT&CK framework.

Responsibilities

• Lead and conduct full incident response investigations.
• Perform host forensics across various systems.
• Carry out network forensics and analyze packet flows.
• Use EDR platforms for threat hunting and evidence collection.
• Produce clear incident reports and support cyber defense activities.

Skills

Incident Response

Digital Forensics

Threat Hunting

Networking

Communication

Education

Relevant certifications (GCFE, GCFA, GREM, CISSP, CISM)

Tools

Wireshark

CrowdStrike

Microsoft Defender

Velociraptor

X-Ways

Autopsy/FTK

Job description

Overview

Cyber Incident Response Lead (Contract)

6-month initial contract | January start | Inside IR35 | UK-wide (travel to London 1 day/month)

Must be SC eligible, 5+ years UK residency

We are recruiting for a Cyber Incident Response Lead to support a major organisation with their incident response capability. This is a hands-on technical role for someone who thrives in fast-moving investigations, can lead response activities end-to-end, and is confident working across complex environments.

You can be based anywhere in the UK, with one day per month required in London. Occasional travel to client sites may be required (rare).

Key Responsibilities

• Lead and conduct full incident response investigations: triage, containment, eradication and recovery.
• Perform host forensics across Windows, Linux, macOS and cloud workloads.
• Carry out network forensics using tools such as Wireshark, analysing packet flows, IDS alerts and lateral movement indicators.
• Use EDR platforms such as CrowdStrike, Microsoft Defender, Velociraptor (or similar) for threat hunting, evidence collection and response actions.
• Perform forensic analysis using tools like X-Ways, Autopsy/FTK, and other digital forensics suites.
• Use sandboxing and malware detonation environments to analyse suspicious files and behaviours.
• Produce clear incident reports, contribute to lessons-learned reviews and improve IR playbooks.
• Support proactive cyber defence activities such as table-top exercises, threat simulations, and readiness assessments.

What You’ll Bring

• Strong background in Incident Response, Digital Forensics, Threat Hunting or SOC L3 roles.
• Deep technical understanding of modern attacker TTPs and the MITRE ATT&CK framework.
• Experience analysing evidence across endpoint, network and cloud environments.
• Familiarity with SIEM/IDS/IPS tooling and scripting/automation to accelerate investigations.
• Excellent communication and ability to work calmly in high-pressure situations.
• Relevant certs desirable (not essential): GCFE, GCFA, GREM, CISSP, CISM, etc.
• SC eligible — must have lived in the UK for the last 5 years.