Incident Response Analyst: Forensics, Hunting & Containment

CyberOne; City Of London; Hybrid; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Career growth opportunities

Continuous learning & certifications

Access to MXDR platform & SecOps tools

Job summary

CyberOne is seeking an experienced Incident Response Analyst to join our Cyber Security team. You will lead investigations, perform digital forensics, and drive improvements in detection and response across client environments.

You will work with SIEM/EDR platforms, collaborate with security teams and clients, and contribute to developing playbooks and runbooks to strengthen cyber resilience.

Qualifications

• Experience in Cyber Incident Response, SOC, or Cyber Defence environments.
• Experience investigating security incidents using SIEM and EDR/XDR platforms.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain, and NIST Incident Response frameworks.
• Understanding of enterprise networking, IAM, cloud security, and data protection controls.
• Strong analytical and communication skills.

Responsibilities

• Monitor and analyse alerts from SIEM/EDR to identify suspicious activity.
• Lead or support investigations into phishing, malware, and data loss.
• Coordinate containment, eradication, and recovery activities with teams and clients.
• Maintain incident records, timelines, evidence, and decision logs.
• Produce incident reports, management updates, and post-incident summaries.
• Develop detection rules and threat hunting content.

Skills

Cyber Incident Response

Security Operations

SIEM Investigations

IR Lifecycle

Windows/Linux Analysis

Investigation Reporting

MITRE ATT&CK

NIST Frameworks

Cloud Security

Education

Cyber Security Degree

Tools

EnCase

Wireshark

PowerShell

Python

KQL

Job description

CyberOne is seeking an experienced Incident Response Analyst to join our Cyber Security team. You will lead investigations, perform digital forensics, and drive improvements in detection and response across client environments.

You will work with SIEM/EDR platforms, collaborate with security teams and clients, and contribute to developing playbooks and runbooks to strengthen cyber resilience.