Digital Forensics and Incident Response Consultant

Consult; United Kingdom; Remote; GBP 108,000 - 132,000; Full time

Job summary

Outbreach is building a bench of DFIR practitioners who carry forensic work inside live incidents, from evidence collection through to the client-facing report. You will acquire evidence, build timelines and write evidential reports for insurers, regulators or courts, working alongside an Incident Manager on mid-market ransomware, data theft and BEC cases.

Minimum 5 years in cyber security with hands-on DFIR; GCFA/GCFE/GNFA/GREM/GCIH certifications are highly valued; right to work in the UK is

Qualifications

• 5+ years cyber security experience with hands-on DFIR on real incidents.
• Evidence acquisition and analysis in practice: disk and memory imaging, triage collection at scale.

Responsibilities

• Acquire evidence with defensible chain of custody across endpoints, servers, memory, network and cloud.
• Build the incident timeline from artefacts using Windows/Linux internals and log analysis.
• Investigate Microsoft 365/Entra ID compromise and cloud logging in AWS/Azure/Google Cloud.
• Scope data exfiltration and determine what was taken; drive client notifications.
• Triage malware and apply deeper reverse engineering where warranted.
• Write forensic reports to evidential standards and explain findings to insurers, regulators or courts.
• Communicate findings to the Incident Manager, legal counsel and communications teams in accessible language.

Skills

Cyber security

Digital forensics

Incident response

Scripting Python/PowerShell

Report writing

GCFA/GCFE/GNFA/GREM/GCIH

Education

GCFA/GCFE/GNFA/GREM/GCIH certifications

Tools

Velociraptor

KAPE

X-Ways

Magnet Axiom

EnCase

FTK

Volatility

Splunk

Microsoft Sentinel

KQL

Job description

Outbreach is building the bench of DFIR practitioners who do the forensic work inside a live incident, from evidence acquisition through to the report the client, their insurer and their lawyers rely on.

You would be the person who acquires the evidence, works out what actually happened, and writes the account of it that the client, their insurer, their lawyers and sometimes a regulator will rely on. Our incidents are mid market and fast moving: ransomware, business email compromise, data theft and insider cases. You would work alongside an Incident Manager who owns the client relationship, so your time goes on the technical investigation rather than on running the crisis.

Key Responsibilities

• Acquire evidence properly and defensibly across endpoints, servers, memory, network and cloud, with chain of custody that stands up later.
• Triage at speed under pressure, and separate what is known, what is suspected and what is not yet established.
• Build the incident timeline from the artefacts, using host and endpoint forensics, Windows and Linux internals and log analysis across the estate.
• Investigate Microsoft 365 and Entra ID compromise, including the unified audit log, token and conditional access abuse and mailbox rules.
• Investigate cloud intrusions in AWS, Azure or Google Cloud using the provider's own logging.
• Scope data exfiltration and establish what was actually taken, which is the question that drives the client's notification obligations.
• Triage malware found in the environment and call in deeper reverse engineering where it is warranted.
• Determine root cause and initial access, set out the containment and eradication actions for the client's team, and verify they worked.
• Write forensic reports and statements to an evidential standard, and be prepared to explain your findings to an insurer, a regulator or a court.
• Feed findings to the Incident Manager, legal counsel and communications as the picture develops, in language each of them can use.

Skills and Experience

• Minimum 5 years cyber security experience is required for this role, with at least 3 of them doing hands on digital forensics and incident response on real incidents.
• Evidence acquisition and analysis in practice: disk and memory imaging, triage collection at scale, and the discipline that keeps evidence admissible.
• Two or more of Velociraptor, KAPE, X-Ways, Magnet Axiom, EnCase, FTK, Volatility or the Zimmerman tools, plus a SIEM such as Splunk or Microsoft Sentinel and query languages including KQL.
• Cloud and identity forensics across Microsoft 365, Entra ID and at least one of AWS, Azure or Google Cloud.
• Ransomware casework, including encryption scoping, persistence hunting, exfiltration assessment and the realities of recovery.
• Scripting in Python or PowerShell to make the work repeatable.
• Writing. Our reports are read by non technical people who make expensive decisions on them.
• Certifications such as GCFA, GCFE, GNFA, GREM or GCIH, or equivalent proof of the same ability.
• Right to work in the UK.

Highly desirable but not vital

• Experience as an expert witness, or casework that reached litigation or a regulator.
• Reverse engineering or malware analysis depth.
• Experience from a consultancy, a DFIR firm or a regulated in house CSIRT.
• Operational technology or cloud native incident experience.
• Security clearance.

Commitment

This is a bench role. You are called when an incident matches your skills and experience, there is no expectation that you sit on call, and you can decline work. Rates are hourly, agreed before an engagement starts, and equivalent to over 120,000 pounds a year on a full time basis.