DFIR Analyst

Pen Test Partners; England; À distance; GBP 70 000 - 110 000; Plein temps

Avantages offerts par ce poste

Private Medical Insurance

Group pension

Training & conference funding

EV salary sacrifice

Résumé du poste

Pen Test Partners is seeking an experienced DFIR Analyst to join our growing team. This role combines hands-on incident response with client-facing advisory work, onboarding retainer clients and responding to live incidents across endpoints, cloud, and networks.

You will lead investigations end-to-end, build timelines, produce structured reports, and act as a trusted advisor during high-pressure incidents, with remote work and occasional client-site travel.

Qualifications

• Proven experience (typically 5+ years) in incident response, SOC operations, cybersecurity consulting.
• Ability to lead investigations and make decisions under pressure.
• Strong experience producing IR reports, documentation and playbooks for enterprises.
• Familiarity with cloud-based and on-premise environments.

Responsabilités

• Onboard and lead DFIR retainer clients, validate access, tooling, logging, and response readiness.
• Respond to live cyber incidents (ransomware, BEC, account compromise, cloud attacks).
• Conduct compromise assessments across endpoints, cloud and network data sources.
• Perform forensic acquisition and analysis; document evidence to a defensible standard.
• Build timelines and correlate artefacts across multiple data sources.
• Lead containment and eradication activities and validate recovery actions.
• Produce clear IR reports with timelines, root cause and recommendations.
• Define investigation strategy, hypotheses and evidence collection plans.

Connaissances

Incident response

SOC operations

Cybersecurity consulting

Investigation leadership

IR reporting

Cloud & on-prem environments

Independent working

Outils

EDR platforms

SIEM tooling

Forensic tools

Description du poste

Pen Test Partners is an innovative and dynamic organisation committed to providing a supportive environment where our people can not only thrive but actively shape our culture and direction.

With over 120 employees across penetration testing, consultancy, digital forensics, sales, and support functions, we pride ourselves on attracting talented individuals and giving them the environment to develop and perform at their best. From real-world incident response to cutting-edge research, we deliver meaningful, high-impact work for our clients.

We have ambitious plans and therefore are growing our team and seeking an

experienced DFIR Analyst to expand their skills and join our experienced team.

Overview:

We are seeking a Digital Forensics and Incident Response (DFIR) Analyst to join our growing team.

This role combines hands‑on technical incident response with client‑facing advisory work. You will support onboarding of incident response retainer clients, respond to live incidents, and perform compromise assessments across a wide range of environments. Depending on experience, you may lead investigations end‑to‑end and act as a trusted advisor to clients during high‑pressure incidents.

Core Responsibilities

Support and lead the onboarding of DFIR retainer clients, validating access, tooling, logging coverage, and incident response readiness.

Respond to live cyber incidents, including ransomware, business email compromise (BEC), account compromise, and cloud‑based attacks.

Perform compromise assessments across endpoint, cloud, and network data sources to identify evidence of attacker activity.

Conduct forensic acquisition and analysis across systems and environments, ensuring evidence is handled and documented to a defensible standard.

Build timelines and correlate artefacts across multiple data sources (e.g. endpoint telemetry, logs, identity platforms, cloud services).

Support and lead containment and eradication activities, including host isolation, credential resets, and validation of recovery actions.

Produce clear, structured reports covering investigation findings, timelines, root cause, and recommendations.

Define investigation strategy, hypotheses, and evidence collection plans, and take ownership of engagements end‑to‑end.

Client Advisory & Collaboration

Work closely with client technical teams during onboarding, investigations, and remediation.

Support clients during live incidents, helping them understand risks and make informed decisions under pressure.

Contribute to incident response readiness reviews, identifying gaps in logging, detection, and operational processes.

Translate technical findings into clear, actionable recommendations for both technical and non‑technical stakeholders.

lead client briefings and act as a trusted advisor throughout the incident lifecycle.

Team Contribution & Development

Contribute to the development and improvement of DFIR playbooks, SOPs, and investigation methodologies.

Support knowledge sharing through internal case reviews and documentation.

Required experience and skills

Proven experience (typically 5+ years) in incident response, SOC operations, cybersecurity consulting.

Ability to lead investigations and make decisions under pressure

Demonstrated ability to product high‑quality IR reports, documentation and playbooks for enterprises.

Deep understanding of modern threat actors, attack methodologies and incident response lifecycle

Experience across cloud based and on‑premise enterprise environments.

Ability to work independently, meeting deadlines, and drive deliverables with minimal supervision

Preferred qualifications and experience:

GCIH, GCFA, CISSP or equivalent certifications.

Prior participation in or leading of real‑world cyber incident response activities.

Familiarity with identity governance, EDR platforms, SIEM tooling and cloud security architecture

Strong background in system administration and networking.

Familiarity with threat intelligence sources and the ability to translate intelligence into actionable responses.

Proficiency in using forensic tools and methodologies.

Excellent communication skills with the ability to convey technical information to non‑technical stakeholders.

Strong problem‑solving and analytical skills.

What can you expect from us?

Competitive salary based on experience

Private Medical Insurance and Healthcare Benefit on completion of probation

Group personal pension

Financing available for training and conference attendance

EV lease salary sacrifice scheme on completion of probation

An environment where you can flourish, learn, and grow, as a person not just as an employee

You’ll be working from home, though some onsite travel to client sites (including

international) may be required. Although we are a remote working company, we pay

for our teams to meet regularly throughout the year holding local and company