Cyber Incident Response Lead & Tooling Developer (Hybrid London)

Control Risks Group; Greater London; Hybrid; GBP 70,000 - 110,000; Full time

Job summary

Control Risks Group in London is seeking a Cyber Incident Response Consultant to join our hybrid team. You will lead host, network, web server and cloud investigations, including ransomware, for clients across sectors, developing tooling and automation, and contributing to threat intelligence.

Fluent English, strong forensics and scripting skills are essential. Based in London with hybrid work three days a week in the office, you will collaborate with the Cyber Crisis Management team and report

Qualifications

• Proven experience investigating complex cyber incidents as part of an incident response team.
• Technical degree or strong knowledge of enterprise networks and systems.
• Strong understanding of enterprise infrastructure, web servers and cloud environments.
• Experience in conducting log analysis and digital forensics following a cyber incident.
• Fluent in English, with excellent presentation and analytical skills.
• Scripting or development experience.

Responsibilities

• Lead and assist host, network, web server, and cloud investigations into complex cyber incidents, including ransomware.
• Investigate incidents affecting SaaS platforms and CI/CD environments.
• Threat hunt and identify attacker activity using EDR tooling.
• Perform live compromise assessments for organisations with active intrusions.
• Develop and refine investigative toolsets and automation.
• Provide client reports and ensure findings are clearly communicated.
• Join on-call duty rota and contribute to cyber response maturity.

Skills

Incident response

Threat hunting

Digital forensics

Scripting / development

English language

Education

Technical degree

Tools

EDR tooling

Sigma rules

YARA signatures

SNORT rules

Cloud platforms (Azure/AWS/GCP)

Job description

Control Risks Group in London is seeking a Cyber Incident Response Consultant to join our hybrid team. You will lead host, network, web server and cloud investigations, including ransomware, for clients across sectors, developing tooling and automation, and contributing to threat intelligence.

Fluent English, strong forensics and scripting skills are essential. Based in London with hybrid work three days a week in the office, you will collaborate with the Cyber Crisis Management team and report