Microsoft‑Focused Incident Response Consultant

Quorum Cyber; City of Edinburgh; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Excellent salary

World-class benefits

Access to latest technology

Development opportunities

Job summary

Quorum Cyber, founded in Edinburgh, seeks an Incident Response Consultant to investigate and respond to cyber security incidents across diverse environments. You will own investigative workstreams, perform forensics, and identify TTPs, contributing to customer guidance and remediation for MDR and SOC engagements.

You will work with Microsoft security telemetry, Defender, Sentinel, Entra, and Azure environments, while advancing AI-enabled IR workflows and ensuring evidence integrity throughout

Qualifications

• Experience conducting cyber security investigations across Windows, Linux, macOS, and cloud platforms.
• Proficient in memory and host forensics with evidence-handling best practices.
• Ability to translate technical findings into clear customer guidance.
• Knowledge of MDR/SOC operations and incident lifecycle.
• A mindset for AI-enabled incident response and automation.

Responsibilities

• Support investigations into cyber security incidents and own defined workstreams.
• Perform host, network, and memory forensics and artefact analysis.
• Identify attacker TTPs and map to IOCs.
• Analyse logs, traffic, and artifacts to establish timelines and impact.
• Maintain chain-of-custody and evidence handling.
• Collaborate with SOC, MDR, Threat Intelligence and other teams.
• Advise customers on Microsoft security telemetry and Defender usage.
• Contribute to testing and deployment of AI-enabled IR workflows.
• Review AI-generated findings and escalate where needed.

Skills

Forensic analysis

Memory forensics

Network/log analysis

EDR/SIEM proficiency

Microsoft security stacks

Incident response

AI/automation in IR

Evidence handling

Customer advisory

Threat hunting

Tools

EDR

SIEM

Microsoft Defender

Sentinel

Entra

Azure

Microsoft 365

Playbooks/Scripts

Job description

Quorum Cyber, founded in Edinburgh, seeks an Incident Response Consultant to investigate and respond to cyber security incidents across diverse environments. You will own investigative workstreams, perform forensics, and identify TTPs, contributing to customer guidance and remediation for MDR and SOC engagements.

You will work with Microsoft security telemetry, Defender, Sentinel, Entra, and Azure environments, while advancing AI-enabled IR workflows and ensuring evidence integrity throughout