Cyber Incident Response Lead — Forensics & Threat Hunting

Trades Workforce Solutions; Greater London, Manchester; Hybrid; GBP 60,000 - 90,000; Full time

Job summary

A leading cybersecurity firm in the UK is seeking Cyber Incident Response Consultants/Managers to investigate advanced threats and deliver containment. Candidates should have proven experience in incident response and digital forensics, with strong knowledge of modern attack techniques. This hybrid role involves working with enterprise clients and offers training opportunities. Applicants should have relevant certifications and be eligible for SC clearance. Flexibility to work from various locations in the UK is available.

Benefits

World-class training and professional development

Access to advanced technical certifications

Qualifications

• Proven experience in Incident Response, Digital Forensics, or Threat Hunting.
• Strong technical understanding of Windows, Linux, and cloud environments.
• Knowledge of modern attack techniques, malware behaviours, and adversary TTPs.
• Exposure to SIEM/IDS/IPS technologies, with scripting or automation experience.
• Excellent communication and client-facing skills.
• SC clearance or eligibility (must have lived in the UK for 5+ years).

Responsibilities

• Lead and support end-to-end incident response investigations.
• Conduct digital forensics on endpoints, servers, and cloud environments.
• Perform network forensics using tools like Wireshark.
• Utilise EDR platforms for threat hunting and containment.
• Apply forensic analysis tools for investigation.
• Develop incident playbooks and contribute to detection improvements.

Skills

Incident Response

Digital Forensics

Threat Hunting

Communication Skills

Education

CISSP

GCFE

GCFA

GREM

CISM

Equivalent hands-on experience

Tools

CrowdStrike

Microsoft Defender

Velociraptor

Wireshark

X-Ways

Autopsy (FTK)

Job description

A leading cybersecurity firm in the UK is seeking Cyber Incident Response Consultants/Managers to investigate advanced threats and deliver containment. Candidates should have proven experience in incident response and digital forensics, with strong knowledge of modern attack techniques. This hybrid role involves working with enterprise clients and offers training opportunities. Applicants should have relevant certifications and be eligible for SC clearance. Flexibility to work from various locations in the UK is available.