Incident Response Manager/DFIR Manager

Forensic Focus; Greater London; Hybrid; GBP 69,000 - 115,000; Full time

Job summary

Hays is seeking an Incident Response Manager/DFIR Manager for a remote-first role based in London. The position combines hands-on technical delivery (≈70%) with team leadership (≈30%), handling high-profile investigations and coordinating with clients, legal advisers and insurers.

The role requires experience across full-lifecycle incident response, evidence preservation, and advanced forensic tooling, with Magnet AXIOM being advantageous. Weekend on-call and some travel may be required.

Qualifications

• Proven experience managing full-lifecycle incident-response engagements.
• Strong knowledge of evidence preservation and chain-of-custody requirements.
• Experience delivering tabletop exercises and working with legal/insurance stakeholders.

Responsibilities

• Lead ransomware and business email compromise investigations.
• Oversee endpoint, cloud and on-prem forensic activity.
• Act as senior escalation point during live incidents.
• Communicate findings to clients, legal advisers and cyber insurers.

Skills

Incident response

DFIR

Leadership

Client-facing

Tabletop exercises

Forensic tooling

Project management

Tools

Magnet AXIOM

Job description

# Incident Response Manager/DFIR Manager*Hays***London, England**Remote · Manager · Temporary · £90,000.00/yr - £115,000.00/yr### The RoleThis hands-on management role splits approximately 70% technical delivery and 30% leadership. Day-to-day responsibilities include leading ransomware and business email compromise investigations, overseeing endpoint, cloud and on-premises forensic activity, acting as senior escalation point during live incidents, and communicating findings to clients, legal advisers and cyber insurers. Occasional client travel and weekend on-call coverage are required.### Skills & ExperienceCandidates must bring proven experience managing full-lifecycle incident-response engagements, strong knowledge of evidence preservation and chain-of-custody requirements, and practical expertise across forensic tooling — Magnet AXIOM is advantageous. A background in cybersecurity consulting or professional services is expected, alongside experience delivering tabletop exercises and working with legal and insurance stakeholders.### Who It SuitsThis role suits a seasoned DFIR consultant ready to step into a player-manager position, combining deep technical expertise with team leadership and client-facing confidence. It is not suited to traditional IT incident managers or those whose experience is limited to SOC alert triage. Prior people-management or substantial mentoring experience is essential.