Cyber Security Analyst

Experis (Austria); Greater London; Hybrid; GBP 65,000 - 95,000; Full time

Job summary

Experis is seeking an experienced Incident Response Analyst to join a London hybrid, outside IR35, long-term contract with a major cyber security transformation programme for a global financial services organisation.

You will investigate and respond to sophisticated cyber incidents, conduct forensic investigations, and coordinate containment and remediation across enterprise infrastructure, cloud, identity and endpoints. Strong SIEM/EDR/XDR skills are essential.

Qualifications

• Hands-on incident response experience in complex enterprise environments.
• Direct involvement in real security incidents, not just monitoring or triage.
• Strong digital forensics capabilities across endpoint, identity, cloud and network evidence.

Responsibilities

• Lead hands-on investigations into complex security incidents.
• Perform digital forensic investigations and timeline reconstruction.
• Investigate alerts using SIEM, EDR and XDR technologies.
• Coordinate containment, eradication and recovery with engineering teams.
• Map attacker techniques against MITRE ATT&CK and document findings.

Skills

Incident response

Digital forensics

SIEM

EDR/XDR

MITRE ATT&CK

KQL

Threat hunting

Network forensics

Cloud security

Forensics tools

Tools

Velociraptor

FTK

EnCase

Magnet AXIOM

Volatility

Job description

Incident Response Analyst | Outside IR35 | London Hybrid

Urgent Requirement | Long-Term Contract Scope | Leading Microsoft Security Partner

Experis is supporting a leading Microsoft Security Partner delivering a major cyber security transformation programme for a global financial services organisation.

We are seeking experienced Incident Response Analysts with strong digital forensics expertise to join a highly technical security environment, investigating and responding to complex cyber threats across enterprise infrastructure, cloud, identity and endpoint environments.

This is a hands‑on incident response position requiring proven experience managing live security incidents from initial investigation through containment, eradication and recovery.

Location: London, 2 days onsite per week

Start: ASAP

Duration: Initial contract with long-term programme scope

The Role

You will be responsible for investigating and responding to sophisticated cyber security incidents, conducting forensic investigations, establishing the scope and impact of security compromises, and coordinating containment and remediation activities.

Key Responsibilities

• Lead hands‑on investigations into complex security incidents, including compromised accounts, malware infections, ransomware, suspicious endpoint activity and potential lateral movement.
• Conduct digital forensic investigations, collecting and analysing endpoint, identity, cloud and network evidence to identify attacker behaviour and establish incident timelines.
• Investigate security alerts and indicators of compromise using SIEM, EDR and XDR technologies.
• Perform root cause analysis, identify attack vectors and determine the full scope and impact of security incidents.
• Coordinate containment, eradication and recovery activities with infrastructure, cloud and security engineering teams.
• Conduct proactive threat hunting and map attacker techniques against MITRE ATT&CK.
• Preserve forensic evidence, maintain accurate investigation records and produce detailed incident reports.
• Work alongside security engineers and technical stakeholders to improve detection, response and remediation capabilities.
• Proven commercial experience in hands‑on cyber security incident response within complex enterprise environments.
• Demonstrable digital forensics experience, including practical collection, preservation and analysis of forensic evidence during security investigations.
• Direct involvement in investigating and containing real security incidents, rather than solely monitoring, triaging or escalating SOC alerts.
• Strong practical experience investigating threats using SIEM and EDR/XDR security technologies.
• Experience investigating compromised endpoints, identities, suspicious network activity, malware or lateral movement.
• Strong understanding of the complete incident response lifecycle, including investigation, containment, eradication, recovery and post‑incident analysis.
• Ability to analyse security telemetry, reconstruct attack timelines, identify indicators of compromise and establish the extent of an incident.
• Experience documenting technical investigations, communicating findings and supporting remediation activities.
• Microsoft Sentinel, Microsoft Defender XDR and Defender for Endpoint.
• Kusto Query Language (KQL), advanced log analysis and threat hunting.
• Digital forensic tools such as Velociraptor, FTK, EnCase, Magnet AXIOM, Volatility or equivalent technologies.
• Experience responding to ransomware, business email compromise, credential theft and advanced persistent threats.
• Financial services, banking or other heavily regulated enterprise environments.
• DFIR consulting or major incident response experience.

Who We're Looking For

We are particularly interested in experienced Incident Responders, DFIR Analysts, Digital Forensics Consultants, Cyber Defence Specialists and technically strong L3 SOC professionals who have taken direct ownership of complex security investigations.

This is not an entry‑level SOC monitoring role. Hands‑on digital forensics and real‑world incident response experience are essential.