Incident Response Lead - Cloud & Forensics (Hybrid)

Starling; Cardiff; Hybrid; GBP 55,000 - 90,000; Full time

Benefits offered by this job

Private Medical Insurance

Life insurance 4x salary

Perkbox membership

Cycle to Work

Job summary

Starling is seeking a passionate Incident Responder to join the Security Operations team and protect customers, assets and systems with 24/7 coverage. You will report to the Information Security Lead - SecOps Response and own incident handling from detection through recovery.

The role requires 3+ years in cyber incident response and digital forensics, strong communication skills, and the ability to mentor colleagues. We offer hybrid working across UK offices, including Cardiff.

Qualifications

• 3+ years experience in a cyber incident response and digital forensics function.
• Experience in handling incidents.
• Experience in cloud forensics (GCP, AWS).
• Experience in endpoint and server forensics (Windows, MacOS, Linux).
• Experience in network forensics.
• Experience with forensics data acquisition, disk forensics and memory forensics.
• Experience in supporting and planning Tabletop Exercises.
• Understanding of network, cloud and operating system security controls.
• Excellent communication skills to explain complex concepts to diverse audiences.
• Demonstrated teamwork and collaboration in multi‑functional teams.
• Strong time management, problem-solving and interpersonal skills.
• Eagerness to learn and apply knowledge to security challenges.
• Willingness to mentor colleagues.

Responsibilities

• Conduct incident response activities to investigate and contain cyber security incidents.
• Develop and maintain incident response and readiness processes.
• Analyse logs from cloud, endpoint, and network sources to identify root cause and containment steps.
• Plan and participate in Tabletop Exercises.
• Document notes, analysis findings, containment steps, and causes of incidents.
• Collaborate with other teams to analyse, contain, eradicate and recover from incidents.
• Present investigation findings to technical and non-technical audiences.
• Support detection engineering and threat hunting within SecOps.

Skills

Incident response

Digital forensics

Threat hunting

Communication

Teamwork

Time management

Mentoring

Tools

GCP

AWS

Forensic tools

Job description

Starling is seeking a passionate Incident Responder to join the Security Operations team and protect customers, assets and systems with 24/7 coverage. You will report to the Information Security Lead - SecOps Response and own incident handling from detection through recovery.

The role requires 3+ years in cyber incident response and digital forensics, strong communication skills, and the ability to mentor colleagues. We offer hybrid working across UK offices, including Cardiff.