Incident Response & Digital Forensics Lead

Check Point Software Technologies Ltd.; Greater London; Hybrid; GBP 70,000 - 110,000; Full time

Job summary

Check Point Software Technologies Ltd. is seeking an experienced DFIR lead in the Greater London area to drive end-to-end incident response and digital forensics investigations across industries.

You will scope, contain, remediate, and report on incidents, analyze Windows artifacts and telemetry, and coordinate with global teams to determine attacker TTPs and impact. You will develop conclusive remediation recommendations, create customer-facing reports, and contribute to incident response

Qualifications

• 5+ years of cybersecurity experience.
• Minimum 2 years of hands-on DFIR/Incident Response in confirmed compromises.
• Proven ability to conduct forensic investigations: initial access, root cause, attacker activity, persistence, lateral movement, scope and impact.
• Experience analyzing Windows artifacts, endpoint telemetry, event logs, auth activity, and network evidence.
• Experience with complex incidents (ransomware, identity compromise, enterprise intrusions).
• Strong written and verbal communication; able to present findings to customers and senior stakeholders.
• Able to work during high-severity incidents and participate in on-call rotations (weekends).Domestic and international travel may be required.

Responsibilities

• Lead and perform end-to-end Incident Response and Digital Forensics investigations from scoping to containment, remediation, and reporting.
• Perform forensic analysis of compromised Windows and other systems to determine initial access, root cause, attacker activity, persistence, and scope.
• Analyze endpoint, OS, authentication, network, and security telemetry to reconstruct attacker activity and identify IOC.
• Lead response efforts during complex, large-scale, and global security incidents.
• Develop containment, eradication, recovery, and remediation recommendations for affected environments.
• Produce detailed incident reports documenting attack vectors, findings, impact, and recommended actions.
• Communicate technical findings and incident status to customer technical teams and senior stakeholders.
• Develop and improve incident response plans, playbooks, and lab environments.
• Collaborate with global incident responders, forensic investigators, security researchers, and customer teams.

Skills

Incident Response

Digital Forensics

Windows Forensics

Threat Analysis

Communication

Tabletop Exercises

On-call Readiness

Team Collaboration

Investigation Scoping

Containment & Remediation

Job description

Check Point Software Technologies Ltd. is seeking an experienced DFIR lead in the Greater London area to drive end-to-end incident response and digital forensics investigations across industries.

You will scope, contain, remediate, and report on incidents, analyze Windows artifacts and telemetry, and coordinate with global teams to determine attacker TTPs and impact. You will develop conclusive remediation recommendations, create customer-facing reports, and contribute to incident response