Incident Response / DFIR Analyst

Forensic Focus; Greater London; Hybrid; GBP 83,000 - 103,000; Part time

Job summary

Forensic Focus is seeking an Incident Response / DFIR Analyst for a hybrid contract role in London. You will triage and investigate alerts across SIEM, EDR/XDR, identity, email, cloud and network platforms, leading or supporting investigations into phishing, malware, compromise and data loss.

You will coordinate containment with clients, run review meetings and perform forensic analysis across host, network and cloud artefacts, spanning the full incident lifecycle.

Qualifications

• Hands-on DFIR, SOC or incident response experience.
• Strong knowledge of Windows and Linux analysis, authentication logs and network traffic.
• Familiarity with MITRE ATT&CK and NIST frameworks.

Responsibilities

• Triage and investigate alerts across SIEM, EDR/XDR, identity, email, cloud and network platforms.
• Coordinate containment with clients and run review meetings.
• Carry out forensic analysis across host, network and cloud artefacts.
• Lead or support investigations across the full incident lifecycle.

Job description

# Incident Response / DFIR Analyst*LT Harper Recruitment Group***London, England**Hybrid · Mid · Contract · £60.00/hr - £75.00/hr### The RoleYou triage and investigate alerts across SIEM, EDR/XDR, identity, email, cloud and network platforms, leading or supporting investigations into phishing, malware, compromise and data loss. You coordinate containment with clients, run review meetings and carry out forensic analysis across host, network and cloud artefacts.### Skills & ExperienceRequires hands-on DFIR, SOC or incident response experience, strong knowledge of Windows and Linux analysis, authentication logs and network traffic, plus familiarity with MITRE ATT&CK and NIST frameworks. Tools such as Sentinel, Defender XDR, Velociraptor, Volatility, EnCase, FTK or Wireshark, and certifications like GCIH, GCFA or SC-200 are advantageous.### Who It SuitsSuited to an experienced incident responder comfortable working directly with clients under pressure, who enjoys variety across different environments and wants exposure to the full incident lifecycle, from forensics through to detection engineering.Typical advertised salary forIncident Response roles in United Kingdom:**£58,000–£90,000**(median £70,000 — from33 recent listings analysed by Forensic Focus).Compare Incident Response salaries in United Kingdom →Certifications mentioned:GCFA · GCIH — find training for these on theDFIR Training Finder.Learn More/Apply