Lead Incident Response & Forensics Analyst

Check Point Software; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

Check Point Software in London seeks a seasoned DFIR/Incident Response expert to lead end-to-end investigations across global deployments. You will analyze Windows forensic artifacts, correlate telemetry, and deliver detailed reports to customers and senior stakeholders. Willingness to on-call and travel is required.

The role emphasizes containment, remediation, and improving incident response plans, with collaboration across multiple teams and geographies.

Qualifications

• 5+ years of cybersecurity experience.
• Minimum 2 years of hands-on DFIR/Incident Response experience investigating confirmed system or enterprise compromises.
• Demonstrated experience conducting forensic investigations to determine:
• Initial access and root cause
• Persistence mechanisms
• Credential compromise
• Privilege escalation
• Lateral movement
• Attacker TTPs
• Scope and impact of compromise
• Hands-on experience analyzing Windows forensic artifacts, endpoint telemetry, event logs, authentication activity, and network evidence.
• Experience responding to complex incidents such as ransomware, identity compromise, malware infections, and enterprise intrusions.
• Ability to independently scope and drive an investigation and develop defensible remediation recommendations.
• Strong experience producing customer-facing incident reports and presenting technical findings clearly.
• Experience developing incident response plans and playbooks.
• Strong analytical, troubleshooting, and communication skills.
• Ability to work effectively during high-severity incidents requiring coordination across multiple teams and geographies.
• Ability to participate in an on-call rotation, including at least one weekend per month.
• Domestic and international travel may be required.

Responsibilities

• Lead and perform end-to-end Incident Response and Digital Forensics investigations, from initial scoping through containment, forensic investigation, remediation, and final reporting.
• Perform forensic analysis of compromised Windows and other enterprise systems to determine initial access, root cause, attacker activity, persistence, lateral movement, scope, and impact.
• Analyze endpoint, operating system, authentication, network, and security telemetry to reconstruct attacker activity and identify indicators of compromise.
• Lead response efforts during complex, large-scale, and global security incidents.
• Perform enterprise-wide compromise assessments to identify affected systems and evidence of malicious activity.
• Develop clear containment, eradication, recovery, and remediation recommendations.
• Produce detailed, high-quality incident investigation reports documenting attack vectors, attacker TTPs, findings, impact, and recommended actions.
• Clearly communicate technical findings and incident status to customer technical teams and senior stakeholders.
• Develop and improve incident response plans, procedures, and playbooks.
• Design realistic cyberattack scenarios and facilitate tabletop exercises.
• Build and maintain forensic and malware-analysis lab environments.
• Collaborate with global incident responders, forensic investigators, security researchers, and customer teams.

Job description

Check Point Software in London seeks a seasoned DFIR/Incident Response expert to lead end-to-end investigations across global deployments. You will analyze Windows forensic artifacts, correlate telemetry, and deliver detailed reports to customers and senior stakeholders. Willingness to on-call and travel is required.

The role emphasizes containment, remediation, and improving incident response plans, with collaboration across multiple teams and geographies.