Cyber Security Analyst

TRIA; Greater London; Hybrid; GBP 65,000 - 90,000; Full time

Job summary

TRIA is expanding its security team in the UK and seeks an Incident Responder/DFIR Consultant for hybrid work in London or Gloucester. The role covers end-to-end response across endpoints, identities, networks and clouds, with hands-on forensics and evidence handling.

You’ll work with SOC, threat intelligence and detection engineering to protect client environments. You will implement response playbooks, run tabletop exercises and contribute to containment, eradication and recovery.

Qualifications

• Hands-on incident response experience across endpoint, identity, network or cloud environments.
• Practical digital forensics knowledge, particularly Windows forensics, evidence collection and analysis.
• Experience investigating incidents using EDR/XDR and SIEM platforms.
• Understanding of incident containment, eradication and recovery.

Responsibilities

• Investigate and respond to incidents across endpoint, identity, network and cloud environments.
• Conduct digital forensic investigations, including evidence collection and analysis.
• Coordinate containment, eradication and recovery activities.
• Develop incident response plans, playbooks and support tabletop exercises.
• Communicate investigation findings and recommendations directly to customers.

Skills

Incident response

Digital forensics

EDR/XDR

SIEM

Communication skills

Tools

Velociraptor

KAPE

Timesketch

Volatility

PowerShell

SentinelOne

Microsoft Defender XDR

Microsoft Sentinel

Job description

Location: Gloucester or London – Hybrid / Flexible

Type: Permanent

I'm working with a growing cyber security consultancy and MSSP looking for an Incident Responder / DFIR Consultant to join its specialist security team.

You'll investigate and respond to security incidents across customer environments, working alongside experienced SOC, Threat Intelligence and Detection Engineering teams.

Key Responsibilities

• Investigate and respond to incidents across endpoint, identity, network and cloud environments.
• Conduct digital forensic investigations, including evidence collection and analysis.
• Coordinate containment, eradication and recovery activities.
• Develop incident response plans, playbooks and support tabletop exercises.
• Communicate investigation findings and recommendations directly to customers.

What We're Looking For

• Hands-on incident response experience across endpoint, identity, network or cloud environments.
• Practical digital forensics knowledge, particularly Windows forensics, evidence collection and analysis.
• Experience investigating incidents using EDR/XDR and SIEM platforms.
• Understanding of incident containment, eradication and recovery.
• Strong communication skills and confidence working with customers.
• Eligibility for UK SC clearance.

Technologies: Velociraptor, KAPE, Timesketch, Volatility, PowerShell, SentinelOne, Microsoft Defender XDR and Microsoft Sentinel.

Experience with some of these tools is beneficial, but not all are required.

Exposure to incident response planning, tabletop exercises, MSSP environments or OT/ICS security would be advantageous, although training and development are available.

The role includes an incident response on-call rota and occasional customer travel.

You don't need to be an established Senior Incident Responder. Strong SOC or DFIR professionals ready for greater responsibility are encouraged to apply.