Hybrid Incident Response & Forensics Analyst

CyberOne; Greater London; Hybrid; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Continuous learning and certifications

Career growth opportunities

MSSP/cybersecurity specialization path

Job summary

CyberOne is seeking an experienced Incident Response Analyst to join our Cyber Security team. Lead investigations, conduct digital forensics, perform threat hunting, and drive improvements in incident detection and response across diverse client environments.

You will collaborate with Security Operations, Professional Services, and Customer Success teams to deliver exceptional client outcomes, while staying current with emerging threats and industry best practices.

Qualifications

• Hands-on experience in Cyber Incident Response, Security Operations (SOC), or Cyber Defence environments.
• Hands-on experience investigating security incidents using SIEM and EDR/XDR platforms.
• Strong understanding of the incident response lifecycle, including preparation, detection, analysis, containment, eradication, recovery, and lessons learned.
• Experience analysing Windows and Linux systems, authentication events, network traffic, and security logs.
• Ability to create clear investigation reports, management updates, and technical documentation.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain, and NIST Incident Response frameworks.
• Understanding of enterprise networking, identity and access management, cloud security, email security, endpoint protection, vulnerability management, and data protection controls.
• Excellent analytical, problem-solving, and communication skills.
• Ability to work effectively under pressure and manage multiple priorities.
• Understanding of evidence handling, forensic methodologies, and regulatory considerations relevant to cyber investigations.

Responsibilities

• Monitor and analyse alerts from SIEM, EDR/XDR, identity, email, cloud, network, and other security platforms.
• Triage alerts, validate incidents, assess severity and business impact, and escalate per processes.
• Lead or support investigations into cyber threats including phishing, malware, account compromise, unauthorised access, data loss, and network attacks.
• Coordinate containment, eradication, and recovery activities with internal teams and client stakeholders.
• Maintain incident records, timelines, evidence, actions, and decision logs.
• Produce incident reports, management updates, and post-incident summaries.
• Collect, preserve, and analyse endpoint, server, identity, network, email, and cloud artefacts according to forensic best practices.
• Perform host and network analysis using security logs, packet captures, forensic images, and telemetry data.
• Identify indicators of compromise and map findings to MITRE ATT&CK.
• Support sensitive investigations while maintaining evidence integrity and chain-of-custody.
• Engage internal and external forensic specialists when appropriate.
• Develop and execute proactive, intelligence-led threat hunting activities.
• Create, tune, and optimise detection rules, correlation logic, security monitoring content, and custom indicators.
• Identify and address detection gaps uncovered during investigations.
• Support purple-team exercises and security control validation.

Skills

Incident response

Security operations

Threat hunting

Investigation reporting

Analytical thinking

Communication

MITRE ATT&CK

NIST

Education

Degree in Cyber Security

Degree in Computer Science

Information Technology degree

Tools

SIEM

EDR/XDR

PowerShell

Python

KQL

Job description

CyberOne is seeking an experienced Incident Response Analyst to join our Cyber Security team. Lead investigations, conduct digital forensics, perform threat hunting, and drive improvements in incident detection and response across diverse client environments.

You will collaborate with Security Operations, Professional Services, and Customer Success teams to deliver exceptional client outcomes, while staying current with emerging threats and industry best practices.