Digital Forensics and Incident Response Analyst

Mishcon de Reya LLP; Greater London; On-site; GBP 65,000 - 90,000; Full time

Job summary

Mishcon de Reya LLP in London is seeking a skilled Cyber Incident Response professional to join our incident response team. You will act as a first responder for cyber incidents reported by clients, investigate, contain, and eradicate threats under CIR and CIE accreditations.

You will coordinate with internal security staff, triage reports, and deliver concrete guidance to clients while documenting findings with precision and clarity.

Qualifications

• Hands-on experience investigating security incidents in a SOC or incident response team.
• Strong ability to scope, document findings, and communicate clearly under pressure.
• Experience extracting and analysing logs from Windows, AD, Azure AD, and M365 services.

Responsibilities

• Respond to client-reported cyber incidents as part of CIR service.
• Assess risks from system alerts and user issues, escalating per playbooks.
• Conduct forensic acquisition and analysis across platforms, including mobile devices.
• Support incident management and remediation guidance for clients.
• Provide specialist advice to internal teams and contribute to security posture improvements.
• Develop intelligence assessments of incidents and threats.

Skills

Incident response

Endpoint security

Microsoft 365 security

Log analysis

PowerShell / Python

Threat intelligence

Communication under pressure

Tools

Defender for Endpoint

Defender for Identity

Purview

M365 Admin Center

Job description

The Department

The Cyber Risk and Complex Investigations team is made up of cyber and investigations specialists who work alongside our legal teams to provide a comprehensive and responsive client service.

Our practice works with clients to support them in the prevention of cyber-crime and the management of sophisticated and often complex cyber-attacks and helping them find digital information that supports their needs.

We have extensive experience of working on cyber security issues with a range of organisations, from large and complex global entities to mid-sized or small firms, start-ups and private individuals. We help our clients implement the cyber security they need to address their threats, ensuring compliance with regulatory standards. If an incident occurs, we use our expertise and experience to help clients manage the technological, legal and reputational risks.

Offering a wider breadth of service and a broader range of solutions than traditional investigators, our team combines cutting edge cyber intelligence skills with innovative investigative techniques, understanding the legal requirement to gather facts and evidence properly, safely and ethically. We assess every investigation to ensure it meets our ethical and quality standards, as well as using a robust review process.

The team provides NCSC and CREST accredited security incident response and digital forensics services both internally and to our external clients and we are looking to grow and develop our response team.

The Role

In this role you will be a key member of our incident response team, acting as a first responder when clients report cyber incidents to us. You will investigate, contain, and eradicate threats as part of our NCSC Cyber Incident Response (CIR) and NCSC Cyber Incident Exercising (CIE) accredited service lines. You will also work alongside our internal security team to assess and respond to internal incidents and security queue items.

You must be comfortable receiving and triaging reported incidents, assessing risks quickly and accurately, escalating where necessary, and keeping clients informed throughout. You will operate under the pressure of live incident response conditions, making sound decisions and calmly developing and executing response plans to deliver concrete outcomes. Strong record-keeping and clear client communication are essential throughout.

Our incident response and digital forensics team operates a forensics lab to support the delivery of forensic services. You will be trained in digital forensics acquisition and investigation, with a particular focus on mobile device forensics. You will also be called upon regularly to support our internal security team and to provide technical advice and guidance to other internal teams to help them deliver the best possible advice to clients.

Responsibilities

• Respond to client-reported cyber incidents as part of our NCSC CIR Standard Level accredited incident response service, conducting technical investigation activities under the direction of the incident lead.
• Assess risks related to system generated alerts and user reported issues, escalating promptly and in line with established playbooks.
• Action or elevate issues promptly and consistently in line with playbooks.
• Identify areas of improvement for process or technology and contribute to their implementation.
• Conduct forensic acquisition and analysis across a range of platforms and media in both incident response and discrete investigation scenarios, including specialist acquisition and examination of mobile devices.
• Assist with incident management, including scoping work, guiding clients through decision making, and supporting containment and eradication.
• Develop intelligence assessments of incidents and other potential threats to clients.
• Support clients with longer term guidance and support with remediation and security uplift activities.
• Provide specialist advice and guidance to internal teams on technical and forensic matters.
• Support the internal security team in assessing and responding to internal incidents, managing the security queue, and contributing to the continuous improvement of internal security posture.
• Contribute to Projects with both time and expertise.
• Provide a high standard of customer experience to our clients.

Skills / Experience

• Hands-on experience investigating security incidents, whether as a SOC analyst reviewing and analysing alerts and events, or as part of an incident response team conducting technical investigations.
• Ability to conduct technical investigations as part of an incident response team, working under the direction of an incident lead to identify, scope, and document findings clearly.
• Strong working knowledge of Windows endpoint environments and the Microsoft 365 security stack, including Defender for Endpoint, Defender for Identity, and Purview. Experience with Mac and Linux environments or Google Workspace is advantageous but not necessary.
• Experience reviewing, triaging, and analysing security events and alerts, with the ability to distinguish genuine threats from noise and identify indicators of compromise across endpoint, identity, and cloud telemetry.
• Experience extracting and analysing logs from Windows systems, Active Directory, Azure AD, M365 services, and other sources to identify evidence of malicious or anomalous
• Experience examining Windows hosts for evidence of compromise, including artefact analysis, persistence mechanisms, lateral movement indicators, and timeline reconstruction. Familiarity with Mac and Linux host examination is advantageous but not necessary.
• A proactive mindset: someone who authors and improves playbooks rather than simply following them, and who develops their own approaches to novel or undocumented incident types.
• Proficiency with one or more scripting languages (PowerShell, Python, or similar) to automate triage tasks, parse artefacts, and accelerate investigations.
• Technical curiosity and a genuine interest in the threat landscape, someone who keeps pace with attacker techniques, emerging TTPs, and defensive tooling, and who can learn quickly and often with limited guidance.
• Experience communicating technical findings clearly to clients and stakeholders in high-pressure situations, including the ability to explain complex security events in plain language is desirable.

Please note that this job profile is not an exhaustive list of duties but merely an outline of the key components of the role. You may be required by your line manager to take on additional responsibilities when requested.

About

About Mishcon de Reya Group

The Mishcon de Reya Group is an independent, international professional services business with law at its heart, employing over 1400 people with over 650 lawyers. It includes the law firm Mishcon de Reya LLP and a collection of leading consultancy businesses that complement the firm's legal services.

Mishcon de Reya LLP is based in London, Oxford, Cambridge, Singapore, Hong Kong and UAE. The firm services an international community of clients and provides advice in situations where the constraints of geography often do not apply. The work the firm undertakes is cross-border, multi-jurisdictional and complex, centred around three increasingly entwined and connected sectors: the Innovation Economy, Private Wealth and Capital, and Real Estate. The firm is known as a disputes powerhouse with a formidable capacity firmwide for dispute resolution.

The Mishcon de Reya Group includes consultancy businesses MDR Discover, MDR Mayfair (in London, Singapore and Dubai), MDR ONE, and MDRi (in Hong Kong). The Group also includes MDR Lab, which invests in the most promising early stage legaltech companies as well as the Mishcon Academy, its in-house place of learning and platform for thought leadership.

In 2024, the Group announced its first strategic acquisition in the alternative legal services market, flexible legal resourcing business Flex Legal. It also acquired a majority stake in Somos, a global group actions management business.

We strive to create a fully diverse and inclusive workplace where all our people are empowered to fulfil their potential. We are proud of our agile working culture and are always happy to talk flexible working.