Incident Response Analyst

Check Point; Greater London; Hybrid; GBP 70,000 - 110,000; Full time

Job summary

Check Point Software Technologies Ltd. is seeking an experienced DFIR lead in the Greater London area to drive end-to-end incident response and digital forensics investigations across industries.

You will scope, contain, remediate, and report on incidents, analyze Windows artifacts and telemetry, and coordinate with global teams to determine attacker TTPs and impact. You will develop conclusive remediation recommendations, create customer-facing reports, and contribute to incident response

Qualifications

• 5+ years of cybersecurity experience.
• Minimum 2 years of hands-on DFIR/Incident Response in confirmed compromises.
• Proven ability to conduct forensic investigations: initial access, root cause, attacker activity, persistence, lateral movement, scope and impact.
• Experience analyzing Windows artifacts, endpoint telemetry, event logs, auth activity, and network evidence.
• Experience with complex incidents (ransomware, identity compromise, enterprise intrusions).
• Strong written and verbal communication; able to present findings to customers and senior stakeholders.
• Able to work during high-severity incidents and participate in on-call rotations (weekends).Domestic and international travel may be required.

Responsibilities

• Lead and perform end-to-end Incident Response and Digital Forensics investigations from scoping to containment, remediation, and reporting.
• Perform forensic analysis of compromised Windows and other systems to determine initial access, root cause, attacker activity, persistence, and scope.
• Analyze endpoint, OS, authentication, network, and security telemetry to reconstruct attacker activity and identify IOC.
• Lead response efforts during complex, large-scale, and global security incidents.
• Develop containment, eradication, recovery, and remediation recommendations for affected environments.
• Produce detailed incident reports documenting attack vectors, findings, impact, and recommended actions.
• Communicate technical findings and incident status to customer technical teams and senior stakeholders.
• Develop and improve incident response plans, playbooks, and lab environments.
• Collaborate with global incident responders, forensic investigators, security researchers, and customer teams.

Skills

Incident Response

Digital Forensics

Windows Forensics

Threat Analysis

Communication

Tabletop Exercises

On-call Readiness

Team Collaboration

Investigation Scoping

Containment & Remediation

Job description

At Check Point, what you do matters. Every day, we protect over 100,000 organizations worldwide from increasingly sophisticated cyber and AI-driven threats, securing their AI transformation.

Our prevention-first approach safeguards hybrid networks, cloud environments, digital workspaces, and AI systems, stopping attacks before they happen.

This is where innovation meetsreal-world impact.You'llhelp customers across industriesoperatewith confidence in a rapidly changing digital world, working alongside smart, curious people who take ownership, challenge assumptions, and solve complex problems.

We'reproud to be recognized by TIME, Newsweek, and Forbes for excellence and workplace culture.

What really sets Check Point apart is the opportunity to grow, contribute, and help companies navigate their AI transformation securely.

Ifyou'reexcited to work at the forefront of AI-driven security on a global scale, this is the place to do it.

• Lead and perform end-to-end Incident Response and Digital Forensics investigations, from initial scoping through containment, forensic investigation, remediation, and final reporting.
• Perform forensic analysis of compromised Windows and other enterprise systems to determine initial access, root cause, attacker activity, persistence, lateral movement, scope, and impact.
• Analyze endpoint, operating system, authentication, network, and security telemetry to reconstruct attacker activity and identify indicators of compromise.
• Lead response efforts during complex, large-scale, and global security incidents.
• Perform enterprise-wide compromise assessments to identify affected systems and evidence of malicious activity.
• Develop clear containment, eradication, recovery, and remediation recommendations.
• Produce detailed, high-quality incident investigation reports documenting attack vectors, attacker TTPs, findings, impact, and recommended actions.
• Clearly communicate technical findings and incident status to customer technical teams and senior stakeholders.
• Develop and improve incident response plans, procedures, and playbooks.
• Design realistic cyberattack scenarios and facilitate tabletop exercises.
• Build and maintain forensic and malware-analysis lab environments.
• Collaborate with global incident responders, forensic investigators, security researchers, and customer teams.

• 5+ years of cybersecurity experience.
• Minimum 2 years of hands-on DFIR/Incident Response experience investigating confirmed system or enterprise compromises.
• Demonstrated experience conducting forensic investigations to determine:
• Initial access and root cause
• Persistence mechanisms
• Credential compromise
• Privilege escalation
• Lateral movement
• Attacker TTPs
• Scope and impact of compromise
• Hands-on experience analyzing Windows forensic artifacts, endpoint telemetry, event logs, authentication activity, and network evidence.
• Experience responding to complex incidents such as ransomware, identity compromise, malware infections, and enterprise intrusions.
• Ability to independently scope and drive an investigation and develop defensible remediation recommendations.
• Strong experience producing customer-facing incident reports and presenting technical findings clearly.
• Experience developing incident response plans and playbooks.
• Strong analytical, troubleshooting, and communication skills.
• Ability to work effectively during high-severity incidents requiring coordination across multiple teams and geographies.
• Ability to participate in an on-call rotation, including at least one weekend per month.
• Domestic and international travel may be required.