Hybrid DFIR Analyst: Incident Response & Forensics Expert

Forensic Focus; Greater London; Hybrid; GBP 83,000 - 103,000; Part time

Job summary

Forensic Focus is seeking an Incident Response / DFIR Analyst for a hybrid contract role in London. You will triage and investigate alerts across SIEM, EDR/XDR, identity, email, cloud and network platforms, leading or supporting investigations into phishing, malware, compromise and data loss.

You will coordinate containment with clients, run review meetings and perform forensic analysis across host, network and cloud artefacts, spanning the full incident lifecycle.

Qualifications

• Hands-on DFIR, SOC or incident response experience.
• Strong knowledge of Windows and Linux analysis, authentication logs and network traffic.
• Familiarity with MITRE ATT&CK and NIST frameworks.

Responsibilities

• Triage and investigate alerts across SIEM, EDR/XDR, identity, email, cloud and network platforms.
• Coordinate containment with clients and run review meetings.
• Carry out forensic analysis across host, network and cloud artefacts.
• Lead or support investigations across the full incident lifecycle.

Job description

Forensic Focus is seeking an Incident Response / DFIR Analyst for a hybrid contract role in London. You will triage and investigate alerts across SIEM, EDR/XDR, identity, email, cloud and network platforms, leading or supporting investigations into phishing, malware, compromise and data loss.

You will coordinate containment with clients, run review meetings and perform forensic analysis across host, network and cloud artefacts, spanning the full incident lifecycle.