Incident Response Investigator (DFIR) - UK

Forensic Focus; City of Edinburgh; Hybrid; GBP 58,000 - 90,000; Full time

Job summary

Forensic Focus is seeking an Incident Response Consultant (UK) to lead end-to-end cyber security investigations across Windows, Linux, macOS, and multi-cloud environments from Edinburgh. You will own workstreams in host, network, and memory forensics, performing log analysis, artefact examination, and evidence handling during active incidents.

The role requires practical DFIR experience with disk image analysis, network traffic review, and memory forensics, plus familiarity with Microsoft

Qualifications

• Practical expertise in digital forensics and incident response.
• Experience with disk image analysis, network traffic review, and memory forensics.
• Familiarity with Microsoft security technologies and telemetry essentials.

Responsibilities

• Handle end-to-end cyber security incident investigations across host, network, and memory forensics.
• Lead defined workstreams during incidents and coordinate with SOC, MDR, and threat intel teams.
• Ensure evidence handling and chain-of-custody standards are maintained throughout incidents.

Skills

Digital forensics

Incident response

Disk image analysis

Network traffic review

Volatile memory forensics

Microsoft security technologies

Job description

Forensic Focus is seeking an Incident Response Consultant (UK) to lead end-to-end cyber security investigations across Windows, Linux, macOS, and multi-cloud environments from Edinburgh. You will own workstreams in host, network, and memory forensics, performing log analysis, artefact examination, and evidence handling during active incidents.

The role requires practical DFIR experience with disk image analysis, network traffic review, and memory forensics, plus familiarity with Microsoft