Incident Response Engineer

NineTech; Greater London; Hybrid; GBP 83,000 - 129,000; Part time

Job summary

NineTech in London is looking for five Incident Response Analysts to join the Cyber Security Incident Response team. Roles include 2 senior and 3 mid-level professionals, focusing on monitoring, triage, threat hunting, forensics, containment and recovery across the organisation.

The team works with technology, risk, legal, compliance and business stakeholders. Strong IR/SOC background, SIEM/EDR proficiency, and reporting skills are essential for success.

Qualifications

• Hands-on experience with SIEM and EDR/XDR technologies.
• Strong incident investigation, triage and response capabilities.
• Experience analysing Windows/Linux logs, endpoint artefacts, network traffic and packet captures.
• Knowledge of incident response lifecycle, threat intelligence and MITRE ATT&CK.
• Understanding of enterprise networking, identity management, cloud security and email security.
• Experience with digital forensics, evidence preservation and incident reporting.
• Threat hunting, malware analysis and detection engineering.
• PowerShell, Python, KQL or other scripting and automation tools.
• Forensic tools such as EnCase, FTK, Velociraptor, Volatility and Wireshark.
• Azure, Microsoft 365 and cloud incident investigations.
• Financial services or other regulated industry experience.
• Certifications such as GCIH, GCFA, GCIA, SC-200, CySA+ or CISSP.

Responsibilities

• Monitor and investigate security alerts across SIEM, EDR/XDR, identity, cloud, email and network security platforms.
• Triage incidents, assess severity and business impact, and coordinate appropriate escalation.
• Investigate cyber threats including phishing, malware, compromised accounts, data breaches and unauthorised access.
• Coordinate incident containment, eradication and recovery with relevant technical teams.
• Conduct digital forensic investigations, analysing endpoint, server, network, identity and cloud evidence.
• Identify indicators of compromise (IOCs), attacker techniques and behaviours, using MITRE ATT&CK where appropriate.
• Perform threat hunting and improve security detection rules, monitoring use cases and response capabilities.
• Maintain incident response playbooks, procedures and investigation documentation.
• Produce incident reports, management updates and post-incident reviews.
• Support cyber exercises, root-cause analysis and continuous improvement activities.
• Practical experience in Cyber Security Incident Response, SOC or Security Operations.
• Hands-on experience with SIEM and EDR/XDR technologies.
• Strong incident investigation, triage and response capabilities.
• Experience analysing Windows/Linux logs, endpoint artefacts, network traffic and packet captures.
• Knowledge of incident response lifecycle, threat intelligence and MITRE ATT&CK.
• Understanding of enterprise networking, identity management, cloud security and email security.
• Experience with digital forensics, evidence preservation and incident reporting.

Skills

Incident response

Threat hunting

Digital forensics

Communication skills

Scripting & automation

Cloud security understanding

MITRE ATT&CK knowledge

Stakeholder management

Education

Certifications: GCIH, GCFA, GCIA, SC-200, CySA+ or CISSP

Tools

SIEM

EDR/XDR

EnCase

FTK

Velociraptor

Volatility

Wireshark

PowerShell

Python

KQL

Job description

5 Positions | 2 Senior & 3 Mid-Level

Contract Duration: 6 Months

London 2 days per week 3 days at home

Contract Type: Contract

Role Overview

We are seeking five experienced Incident Response Analysts to join the Cyber Security Incident Response function, comprising 2 Senior-level and 3 Mid-Level professionals.

The team will be responsible for identifying, investigating, managing and resolving cyber security incidents across the organisation. The roles will cover security monitoring, incident triage, threat hunting, digital forensics, containment and recovery, working closely with technology, risk, legal, compliance and business stakeholders.

Key Responsibilities

• Monitor and investigate security alerts across SIEM, EDR/XDR, identity, cloud, email and network security platforms.
• Triage incidents, assess severity and business impact, and coordinate appropriate escalation.
• Investigate cyber threats including phishing, malware, compromised accounts, data breaches and unauthorised access.
• Coordinate incident containment, eradication and recovery with relevant technical teams.
• Conduct digital forensic investigations, analysing endpoint, server, network, identity and cloud evidence.
• Identify indicators of compromise (IOCs), attacker techniques and behaviours, using MITRE ATT&CK where appropriate.
• Perform threat hunting and improve security detection rules, monitoring use cases and response capabilities.
• Maintain incident response playbooks, procedures and investigation documentation.
• Produce incident reports, management updates and post-incident reviews.
• Support cyber exercises, root-cause analysis and continuous improvement activities.
• Practical experience in Cyber Security Incident Response, SOC or Security Operations.
• Hands-on experience with SIEM and EDR/XDR technologies.
• Strong incident investigation, triage and response capabilities.
• Experience analysing Windows/Linux logs, endpoint artefacts, network traffic and packet captures.
• Knowledge of incident response lifecycle, threat intelligence and MITRE ATT&CK.
• Understanding of enterprise networking, identity management, cloud security and email security.
• Experience with digital forensics, evidence preservation and incident reporting.
• Strong communication skills and ability to work under pressure with technical and senior stakeholders.
• Microsoft Sentinel, Defender XDR, Defender for Identity and Defender for Cloud.
• Threat hunting, malware analysis and detection engineering.
• PowerShell, Python, KQL or other scripting and automation tools.
• Forensic tools such as EnCase, FTK, Velociraptor, Volatility and Wireshark.
• Azure, Microsoft 365 and cloud incident investigations.
• Financial services or other regulated industry experience.
• Certifications such as GCIH, GCFA, GCIA, SC-200, CySA+ or CISSP.