NMC Cyber Incident Responder (Digital Forensics)

Forensic Focus Limited; Wigan; Hybrid; GBP 36,000 - 52,000; Full time

Job summary

Police Digital Service in Wigan seeks an NMC Cyber Incident Responder (Digital Forensics) to lead investigations into ransomware, malware and unauthorized access within the National Management Centre. You will perform forensic acquisitions and analyses across endpoints, servers and cloud environments, delivering defensible findings to operational and legal audiences.

You’ll brief Chief Officers and senior IT leaders throughout incident lifecycles, blending deep technical forensics with

Qualifications

• Enterprise digital forensic investigations
• Endpoint and memory forensics
• Log analysis using EDR telemetry and SIEM platforms
• Windows internals and OS artefacts
• Attacker tradecraft and MITRE ATT&CK
• Forensic best-practice evidence handling and incident response lifecycle methodologies

Responsibilities

• Forensic acquisitions and analyses of endpoints, servers and cloud environments.
• Produce defensible findings for operational and legal audiences.
• Brief Chief Officers and senior IT leaders throughout incident lifecycles.

Skills

Digital forensics

Endpoint forensics

Memory forensics

Log analysis

EDR telemetry

SIEM

Windows internals

OS artefacts

MITRE ATT&CK

Incident response lifecycle

Tools

EDR

SIEM

Job description

# NMC Cyber Incident Responder (Digital Forensics)*Police Digital Service***Wigan, England**Hybrid · Senior · Full-time### The RoleWorking within a National Management Centre Cyber Incident Response team, the role involves leading investigations into ransomware, malware, unauthorised access and insider threat incidents affecting UK policing. Day-to-day responsibilities include forensic acquisition and analysis of endpoints, servers and cloud environments, producing defensible findings for operational and legal audiences, and briefing Chief Officers and senior IT leaders throughout incident lifecycles.### Skills & ExperienceCandidates should have hands-on experience in enterprise digital forensic investigations, endpoint and memory forensics, and log analysis using EDR telemetry and SIEM platforms. Strong knowledge of Windows internals, OS artefacts, attacker tradecraft and frameworks such as MITRE ATT&CK is expected. Experience with forensic best-practice evidence handling and incident response lifecycle methodologies is essential.### Who It SuitsThis role suits an experienced DFIR professional comfortable operating at the intersection of technical forensics and senior stakeholder engagement. Those with a background in law enforcement or public-sector cyber security will find the national policing context particularly relevant, though strong private-sector practitioners with enterprise IR experience are equally well placed.Typical advertised salary forDigital Forensics roles in United Kingdom:**£36,000–£52,000**(median £43,000 — from64 recent listings analysed by Forensic Focus).Compare Digital Forensics salaries in United Kingdom →Learn More/Apply