Hybrid Incident Responder & DFIR Consultant

TRIA; Greater London; Hybrid; GBP 65,000 - 90,000; Full time

Job summary

TRIA is expanding its security team in the UK and seeks an Incident Responder/DFIR Consultant for hybrid work in London or Gloucester. The role covers end-to-end response across endpoints, identities, networks and clouds, with hands-on forensics and evidence handling.

You’ll work with SOC, threat intelligence and detection engineering to protect client environments. You will implement response playbooks, run tabletop exercises and contribute to containment, eradication and recovery.

Qualifications

• Hands-on incident response experience across endpoint, identity, network or cloud environments.
• Practical digital forensics knowledge, particularly Windows forensics, evidence collection and analysis.
• Experience investigating incidents using EDR/XDR and SIEM platforms.
• Understanding of incident containment, eradication and recovery.

Responsibilities

• Investigate and respond to incidents across endpoint, identity, network and cloud environments.
• Conduct digital forensic investigations, including evidence collection and analysis.
• Coordinate containment, eradication and recovery activities.
• Develop incident response plans, playbooks and support tabletop exercises.
• Communicate investigation findings and recommendations directly to customers.

Skills

Incident response

Digital forensics

EDR/XDR

SIEM

Communication skills

Tools

Velociraptor

KAPE

Timesketch

Volatility

PowerShell

SentinelOne

Microsoft Defender XDR

Microsoft Sentinel

Job description

TRIA is expanding its security team in the UK and seeks an Incident Responder/DFIR Consultant for hybrid work in London or Gloucester. The role covers end-to-end response across endpoints, identities, networks and clouds, with hands-on forensics and evidence handling.

You’ll work with SOC, threat intelligence and detection engineering to protect client environments. You will implement response playbooks, run tabletop exercises and contribute to containment, eradication and recovery.