Cyber Incident Response Lead & Forensics Consultant

Ubds-Group; Greater London; On-site; GBP 90,000 - 110,000; Full time

Benefits offered by this job

Private medical cover

Discretionary bonus

25 Days holiday

Job summary

UBDS Group in London or Manchester seeks an experienced Cyber Incident Response Consultant to join our Security and Infrastructure Operations Centre (SIOC). You will lead and support live incident responses across Microsoft and AWS environments, perform digital forensics, and advise customers on containment and remediation strategies.

The role is hands-on, customer-facing and requires strong expertise in EDR, SIEM and forensic tooling, with a focus on delivering robust incident reports and

Qualifications

• Experience in Cyber Incident Response, DFIR, SOC/SIOC or similar cyber security environment.
• Hands-on experience investigating and responding to cyber security incidents.
• Experience supporting or leading customer-facing incident response engagements.
• Strong experience with EDR tooling, SIEM platforms and security log analysis.
• Understanding of incident response processes, including containment, eradication, recovery and lessons learned.
• Practical knowledge of digital forensic techniques, including endpoint, memory, network or cloud forensics.
• Experience collecting and preserving digital evidence, with an understanding of chain-of-custody principles.
• Ability to analyse attacker activity, indicators of compromise and common attack techniques.
• Good understanding of Windows, Linux, networking and cloud security.
• Experience investigating security incidents within Microsoft and/or AWS environments.
• Experience producing technical investigation reports and presenting findings to customers.
• Strong analytical, investigative and problem-solving skills.
• Excellent communication, stakeholder engagement and consultancy skills.

Responsibilities

• Lead or support customer-facing cyber incident response engagements, from initial investigation through containment, eradication, recovery and reporting.
• Investigate security incidents including ransomware, malware, phishing, account compromise and unauthorised access.
• Conduct digital forensic investigations across endpoints, servers, cloud environments and network infrastructure.
• Analyse security logs, endpoint telemetry, forensic artefacts and indicators of compromise to establish incident scope and root cause.
• Use EDR, SIEM and forensic tooling to investigate suspicious activity and reconstruct attack timelines.
• Advise customers on containment decisions, remediation priorities and recovery approaches.
• Support eradication and recovery activities, validating remediation and identifying any remaining security risks.
• Collect, preserve and document digital evidence, following appropriate forensic procedures and chain-of-custody requirements.
• Produce professional incident investigation reports, including findings, timelines, root cause and remediation recommendations.
• Present investigation findings and recommendations to technical teams, customers and senior stakeholders.
• Support threat hunting, detection engineering and improvements to security monitoring capabilities.
• Develop and improve incident response playbooks, processes and procedures.
• Design and support cyber incident exercises, including tabletop scenarios, simulated incidents and response workshops.
• Facilitate or contribute to exercises, evaluating response effectiveness and producing post-exercise recommendations.
• Work closely with SIOC analysts, security engineers, cloud specialists and wider Managed Services colleagues during incidents.
• Provide technical guidance and mentoring to less experienced security professionals.

Skills

Incident response

Digital forensics

Customer-facing

EDR tooling

SIEM

Windows

Linux

Cloud security

Azure/AWS

Reporting

Mentoring juniors

Education

CRIA

GCIH

GCFA

GCFE

SC-200

CySA+

Security+

SANS/CREST DFIR training

Tools

Velociraptor

KAPE

Autopsy

Volatility

Python scripting

Job description

UBDS Group in London or Manchester seeks an experienced Cyber Incident Response Consultant to join our Security and Infrastructure Operations Centre (SIOC). You will lead and support live incident responses across Microsoft and AWS environments, perform digital forensics, and advise customers on containment and remediation strategies.

The role is hands-on, customer-facing and requires strong expertise in EDR, SIEM and forensic tooling, with a focus on delivering robust incident reports and