Incident Response / DFIR Analyst

LT Harper Recruitment Group; Greater London; On-site; GBP 65,000 - 90,000; Full time

Job summary

Forensic Focus is seeking an experienced incident responder to triage and investigate alerts across SIEM, EDR/XDR, identity, email, cloud and network platforms. You will lead or support investigations into phishing, malware, compromise and data loss, coordinating containment with clients and running review meetings.

The role requires hands-on DFIR/SOC experience and strong Windows/Linux analysis skills, with familiarity in MITRE ATT&CK and NIST frameworks.

Qualifications

• Hands-on DFIR, SOC or incident response experience required.
• Strong knowledge of Windows and Linux analysis.
• Familiarity with MITRE ATT&CK and NIST frameworks; credentialed analysts preferred.

Responsibilities

• Triage and investigate alerts across SIEM, EDR/XDR, identity, email, cloud and network platforms.
• Lead or support investigations into phishing, malware, compromise and data loss.
• Coordinate containment with clients and run review meetings.

Skills

DFIR experience

Windows analysis

Linux analysis

Authentication logs

Network traffic analysis

MITRE ATT&CK familiarity

NIST frameworks familiarity

Education

GCIH certification

GCFA certification

SC-200 certification

Tools

Sentinel

Defender XDR

Velociraptor

Volatility

EnCase

FTK

Wireshark

Job description

The Role

You triage and investigate alerts across SIEM, EDR/XDR, identity, email, cloud and network platforms, leading or supporting investigations into phishing, malware, compromise and data loss. You coordinate containment with clients, run review meetings and carry out forensic analysis across host, network and cloud artefacts.

Skills & Experience

Requires hands-on DFIR, SOC or incident response experience, strong knowledge of Windows and Linux analysis, authentication logs and network traffic, plus familiarity with MITRE ATT&CK and NIST frameworks. Tools such as Sentinel, Defender XDR, Velociraptor, Volatility, EnCase, FTK or Wireshark, and certifications like GCIH, GCFA or SC-200 are advantageous.

Who It Suits

Suited to an experienced incident responder comfortable working directly with clients under pressure, who enjoys variety across different environments and wants exposure to the full incident lifecycle, from forensics through to detection engineering.