Incident Response Lead (DFIR)

Forensic Focus Limited; United Kingdom; Hybrid; GBP 90,000 - 110,000; Full time

Job summary

Forensic Focus Limited is seeking an Incident Response Lead (DFIR) to oversee a portfolio of live incidents end-to-end within a cyber consultancy context. The role combines leadership with hands-on digital forensics across disk, memory, network traffic and log data, with on-call duties and occasional travel.

The ideal candidate has deep DFIR experience, proficiency with X-Ways, EnCase, FTK, AXIOM or Cellebrite, and strong analytics across networks, memory forensics and malware reverse

Qualifications

• Significant experience managing complex cyber incidents.
• Strong forensic competency with common DFIR toolsets (X-Ways, EnCase, FTK, AXIOM, Cellebrite).
• Technical depth in network/log analysis, memory forensics, and malware reverse engineering or mobile forensics.

Responsibilities

• Lead end-to-end incident response engagements within a cyber consultancy's practice.
• Oversee scoping, triage, containment, evidence preservation and recovery.
• Conduct and quality-assure digital forensics across disk, memory, network traffic and logs.
• Manage on-call rotation and occasional short-notice travel.

Job description

# Incident Response Lead (DFIR)*LT Harper Recruitment Group***England**Hybrid · Lead/Principal · Full-time · £90,000.00/yr - £110,000.00/yr### The RoleThis hands-on leadership position sits within a cyber consultancy’s incident response practice. Day to day, the postholder manages a portfolio of live incidents end to end — scoping, triage, containment, evidence preservation and recovery — while personally conducting and quality-assuring digital forensics across disk, memory, network traffic and log data. On-call rotation and occasional short-notice travel are required.### Skills & ExperienceCandidates need significant experience managing complex cyber incidents and strong forensic competency with tools such as X-Ways, EnCase, FTK, AXIOM or Cellebrite. Technical depth in network/log analysis, memory forensics, malware reverse engineering or mobile forensics is essential. Python scripting and certifications such as GCFA, GCIH, GNFA or CCIM are highly desirable, as is current SC or DV clearance.### Who It SuitsThe role suits a seasoned DFIR professional ready to step into operational leadership without leaving technical work behind. It offers a clear path to service line leadership, exposure to high-profile government and critical national infrastructure incidents, funded certifications, and a structured progression framework within a growing practice.Typical advertised salary forIncident Response roles in United Kingdom:**£53,000–£90,000**(median £70,000 — from30 recent listings analysed by Forensic Focus).Compare Incident Response salaries in United Kingdom →Certifications mentioned:GCFA · GNFA · GCIH — find training for these on theDFIR Training Finder.Learn More/Apply