Incident Responder

Tria; Painswick; Hybrid; GBP 60,000 - 80,000; Full time

Job summary

Tria is seeking an Incident Responder / DFIR Consultant to join a growing cyber security consultancy and MSSP. The role offers hybrid working between Gloucester or London with a salary of £60,000-£80,000 DOE.

You will investigate incidents across endpoints, identities, networks and cloud environments, perform digital forensics, and lead containment and recovery efforts. Training and travel may be involved.

Qualifications

• Hands-on incident response across endpoint, identity, network or cloud environments.
• Experience with digital forensics, Windows forensics, evidence collection and analysis.
• Familiarity with EDR/XDR and SIEM platforms.
• Understanding of containment, eradication and recovery processes.
• Strong communication with customers.

Responsibilities

• Investigate and respond to incidents across endpoint, identity, network and cloud environments.
• Conduct digital forensic investigations, including evidence collection and analysis.
• Coordinate containment, eradication and recovery activities.
• Develop incident response plans, playbooks and support tabletop exercises.
• Communicate investigation findings and recommendations directly to customers.

Skills

Incident response

Digital forensics

Communication skills

SC clearance (UK)

SOC/DFIR

Tools

Velociraptor

KAPE

Timesketch

Volatility

PowerShell

SentinelOne

Microsoft Defender XDR

Microsoft Sentinel

Job description

Incident Responder / DFIR Consultant

Location: Gloucester or London - Hybrid / Flexible

Salary: £60,000-£80,000 DOE

Type: Permanent

I'm working with a growing cyber security consultancy and MSSP looking for an Incident Responder / DFIR Consultant to join its specialist security team.

Key Responsibilities

• Investigate and respond to incidents across endpoint, identity, network and cloud environments.
• Conduct digital forensic investigations, including evidence collection and analysis.
• Coordinate containment, eradication and recovery activities.
• Develop incident response plans, playbooks and support tabletop exercises.
• Communicate investigation findings and recommendations directly to customers.

What We're Looking For

• Hands-on incident response experience across endpoint, identity, network or cloud environments.
• Practical digital forensics knowledge, particularly Windows forensics, evidence collection and analysis.
• Experience investigating incidents using EDR/XDR and SIEM platforms.
• Understanding of incident containment, eradication and recovery.
• Strong communication skills and confidence working with customers.
• Eligibility for UK SC clearance.

Technologies: Velociraptor, KAPE, Timesketch, Volatility, PowerShell, SentinelOne, Microsoft Defender XDR and Microsoft Sentinel.

Experience with some of these tools is beneficial, but not all are required.

Exposure to incident response planning, tabletop exercises, MSSP environments or OT/ICS security would be advantageous, although training and development are available.

The role includes an incident response on-call rota and occasional customer travel.

You don't need to be an established Senior Incident Responder. Strong SOC or DFIR professionals ready for greater responsibility are encouraged to apply.