Incident Response Analyst

Check Point Software Technologies; England; On-site; GBP 70,000 - 110,000; Full time

Job summary

Check Point Software Technologies in the United Kingdom is seeking an experienced security professional to lead end-to-end DFIR and incident response engagements. The role requires deep forensic capabilities, strong communication with customer teams, and the ability to drive containment, remediation, and reporting across global incidents.

You will analyze Windows and other enterprise systems, develop playbooks, facilitate tabletop exercises, and collaborate with cross-geography teams to minimize

Qualifications

• 5+ years of cybersecurity experience.
• Minimum 2 years of hands-on DFIR/Incident Response on confirmed compromises.
• Proven forensic investigations to determine initial access, root cause, persistence, and attacker activity.
• Experience analyzing Windows artifacts, endpoint telemetry, logs, authentication activity, and network evidence.
• Experience leading incident response for complex, large-scale or global security incidents.

Responsibilities

• Lead and perform end-to-end Incident Response and Digital Forensics investigations from scoping to reporting.
• Analyze compromised systems to determine attacker activity and scope.
• Reconstruct attacker activity using telemetry to identify indicators of compromise.
• Develop containment, eradication, and remediation recommendations.
• Produce detailed incident reports outlining attack vectors, findings, and actions.
• Communicate findings to customer technical teams and senior stakeholders.
• Develop incident response plans, playbooks, and tabletop exercise scenarios.
• Collaborate with global incident responders, forensic investigators, and customer teams.

Skills

DFIR/IR experience

Windows forensics

Incident response leadership

Tabletop exercises

Strong communication

Job description

Job Description

• Lead and perform end-to-end Incident Response and Digital Forensics investigations, from initial scoping through containment, forensic investigation, remediation, and final reporting.
• Perform forensic analysis of compromised Windows and other enterprise systems to determine initial access, root cause, attacker activity, persistence, lateral movement, scope, and impact.
• Analyze endpoint, operating system, authentication, network, and security telemetry to reconstruct attacker activity and identify indicators of compromise.
• Lead response efforts during complex, large-scale, and global security incidents.
• Perform enterprise-wide compromise assessments to identify affected systems and evidence of malicious activity.
• Develop clear containment, eradication, recovery, and remediation recommendations.
• Produce detailed, high-quality incident investigation reports documenting attack vectors, attacker TTPs, findings, impact, and recommended actions.
• Clearly communicate technical findings and incident status to customer technical teams and senior stakeholders.
• Develop and improve incident response plans, procedures, and playbooks.
• Design realistic cyberattack scenarios and facilitate tabletop exercises.
• Build and maintain forensic and malware-analysis lab environments.
• Collaborate with global incident responders, forensic investigators, security researchers, and customer teams.

Qualifications

• 5+ years of cybersecurity experience.
• Minimum 2 years of hands-on DFIR/Incident Response experience investigating confirmed system or enterprise compromises.
• Demonstrated experience conducting forensic investigations to determine:
  • Initial access and root cause
  • Persistence mechanisms
  • Credential compromise
  • Privilege escalation
  • Lateral movement
  • Attacker TTPs
  • Scope and impact of compromise
• Hands-on experience analyzing Windows forensic artifacts, endpoint telemetry, event logs, authentication activity, and network evidence.
• Experience responding to complex incidents such as ransomware, identity compromise, malware infections, and enterprise intrusions.
• Ability to independently scope and drive an investigation and develop defensible remediation recommendations.
• Strong experience producing customer-facing incident reports and presenting technical findings clearly.
• Experience developing incident response plans and playbooks.
• Strong analytical, troubleshooting, and communication skills.
• Ability to work effectively during high‑severity incidents requiring coordination across multiple teams and geographies.
• Ability to participate in an on‑call rotation, including at least one weekend per month.
• Domestic and international travel may be required.