DFIR Analyst

GCS Recruitment Specialists; Gloucester; On-site; GBP 45,000 - 65,000; Full time

Job summary

Unknown is seeking a Digital Forensics Investigator to support complex cyber investigations, incident response activities, and evidence-led enquiries. You will work across endpoints, cloud environments, mobile devices, and enterprise security platforms, applying forensic techniques to identify, preserve, analyse, and present digital evidence.

You will collaborate with internal teams, security stakeholders, legal professionals, and law enforcement to ensure investigations are thorough, accurate,

Job description

Digital Forensics Investigator

Digital Forensics | Cyber Investigations | Incident Response

Are you passionate about uncovering digital evidence, investigating cyber incidents, and helping organisations understand what really happened during a security event?

We're looking for a Digital Forensics Investigator to support complex cyber investigations, incident response activities, and evidence-led enquiries. This role offers the opportunity to work across endpoints, cloud environments, mobile devices, and enterprise security platforms, applying forensic techniques to identify, preserve, analyse, and present digital evidence.

You’ll work closely with internal investigation teams, security stakeholders, legal professionals, and law enforcement to ensure investigations are thorough, accurate, and conducted in accordance with appropriate evidence-handling procedures.

What You’ll Be Doing

• Conduct digital forensic investigations, collecting and analysing electronic evidence to support internal investigations, legal proceedings, and cybersecurity incident response.
• Identify, acquire, preserve, and analyse digital evidence across laptops, servers, mobile devices, cloud platforms, and enterprise environments.
• Investigate suspicious activity, unauthorised access, compromised accounts, data breaches, and other potential security incidents through forensic artefacts and log analysis.
• Analyse Microsoft 365 and other cloud-based environments to identify relevant activity, establish timelines, and support attribution of user or threat actor actions.
• Use digital forensic and eDiscovery tools to investigate incidents, refine large datasets, and develop effective evidence-collection strategies.
• Support incident response activities by analysing logs, endpoint telemetry, network traffic, malware, and other digital artefacts.
• Maintain the integrity, confidentiality, and admissibility of evidence through accurate documentation and strict chain-of-custody procedures.
• Prepare clear, factual forensic reports documenting investigative processes, findings, analysis, and conclusions.
• Collaborate with internal security, compliance, ethics, and investigations teams, as well as external legal advisers, law enforcement, and technology vendors.
• Contribute to the continuous improvement of forensic procedures, investigation methodologies, and evidence-handling protocols.
• Keep up to date with emerging cyber threats, forensic techniques, industry standards, and developments in digital investigation practices.

What We’re Looking For

Education and Qualifications

• An undergraduate qualification in IT, computer science, digital forensics, or a related discipline - or equivalent relevant experience.
• Professional certifications in information security, digital forensics, or incident response are advantageous.
• A postgraduate qualification in computer science, digital forensics, or a related field would be beneficial.

Technical Experience and Knowledge

• Strong understanding of the digital forensic lifecycle: identification, preservation, collection, examination, analysis, documentation, and presentation of evidence.
• Knowledge of the ACPO Good Practice Guide for Digital Evidence and its application to forensic investigations.
• Practical experience using digital forensic and eDiscovery tools such as Magnet AXIOM, Cellebrite, FTK, EnCase, Nuix, Relativity, or Paladin.
• Strong working knowledge of Microsoft 365, cloud platforms, and log analysis, including the ability to investigate suspicious or unauthorised account activity.
• Experience working with Endpoint Detection and Response (EDR) technologies and analysing endpoint telemetry.
• Understanding of SIEM platforms, security monitoring, IDS/IPS, firewalls, and network traffic analysis.
• Experience collecting and analysing evidence from Windows, Linux, and macOS systems, as well as mobile devices, servers, and cloud environments.
• Knowledge of incident response methodologies, cyberattack techniques, threat actors, malware behaviour, and digital artefact analysis.
• Understanding of networking fundamentals, including TCP/IP, routing, subnetting, network architecture, and common network protocols.
• Familiarity with cloud security, encryption, data loss prevention (DLP), and relevant cybersecurity standards and regulations.

Essential Skills and Attributes

• Strong analytical thinking and the ability to connect evidence from multiple systems to establish an accurate sequence of events.
• Excellent attention to detail and a methodical, evidence-led approach to investigations.
• Ability to develop effective evidence-collection and eDiscovery strategies based on the nature of an allegation or incident.
• Strong written communication skills, with the ability to produce clear, objective, and defensible forensic reports.
• An understanding of legal and jurisdictional considerations relating to digital evidence, investigations, and data breaches.
• High levels of integrity, discretion, and professionalism when handling sensitive or confidential information.
• Ability to manage competing priorities, work collaboratively with multidisciplinary teams, and communicate technical findings to non-technical stakeholders.
• A proactive approach to problem-solving, continuous learning, and improving investigative processes.

Why Consider This Opportunity?

This is an opportunity to apply your digital forensic expertise to meaningful cyber investigations, working across a broad range of technologies and evidence sources. You’ll play an important role in uncovering facts, supporting incident response, protecting organisational interests, and ensuring that digital evidence is handled to the highest professional standards.

Interested in learning more?

If you have a background in digital forensics, cyber investigations, or DFIR and enjoy solving complex technical challenges through evidence-based analysis, we’d love to hear from you.