Cyber Incident Response Lead — DFIR & Forensics

UBDS Group; Greater London; On-site; GBP 70,000 - 100,000; Full time

Benefits offered by this job

Private medical cover

Discretionary bonus

25 days holiday + birthday & work-annv

Pension scheme

EV salary sacrifice leasing

Training & certifications

Job summary

UBDS Group is seeking an experienced Cyber Incident Response Consultant for its Security and Infrastructure Operations Centre (SIOC), based in London or Manchester. This hands-on, customer-facing role focuses on investigating, responding to and recovering from cyber incidents across complex environments.

You will lead incident responses, conduct digital forensics, and advise on resilience and response improvements across Microsoft and AWS environments using EDR, SIEM and forensic tooling.

Qualifications

• We are seeking hands-on incident response professionals with DFIR experience.
• Experience investigating and responding to cyber security incidents is essential.
• Proven ability to communicate findings to customers and stakeholders.

Responsibilities

• Lead or support customer-facing incident response engagements from detection through recovery.
• Investigate ransomware, malware, phishing, account compromise and access events.
• Conduct digital forensic investigations across endpoints, servers, cloud, and networks.
• Analyze logs, telemetry and IOC to define scope and root cause.
• Use EDR/SIEM/forensic tooling to reconstruct timelines and incidents.
• Provide containment decisions, remediation priorities and recovery plans.
• Preserve evidence and document procedures with proper chain-of-custody.

Skills

Incident response

DFIR

EDR tooling

SIEM platforms

Forensic analysis

Cloud security

Windows

Linux

Communication

Mentoring

Tools

EDR tooling

SIEM platforms

Forensic tooling

Threat hunting tools

Job description

UBDS Group is seeking an experienced Cyber Incident Response Consultant for its Security and Infrastructure Operations Centre (SIOC), based in London or Manchester. This hands-on, customer-facing role focuses on investigating, responding to and recovering from cyber incidents across complex environments.

You will lead incident responses, conduct digital forensics, and advise on resilience and response improvements across Microsoft and AWS environments using EDR, SIEM and forensic tooling.