Principal Security Consultant

Zenzero Solutions; Poole; On-site; GBP 90,000 - 120,000; Full time

Benefits offered by this job

Private health insurance

Generous holiday allowance + a day off

Enhanced pension contributions

Regular social events across all our 0

Job summary

Zensec, part of the Zenzero Group, is seeking a Principal Security Consultant to lead high-impact DFIR engagements for clients facing sophisticated cyber threats, including ransomware and BEC. You will act as senior technical lead through the incident lifecycle, guiding triage, containment, analysis, and reporting.

You will collaborate with incident managers, SOC, insurers, legal partners, and client leadership, shaping methodology, tooling, and playbooks while mentoring consultants and growing

Qualifications

• Proven ability to lead complex DFIR investigations and client-facing engagements.
• Strong understanding of ransomware lifecycles and adversary tradecraft.
• Expertise in Microsoft 365 and BEC investigations, with log analysis skills.
• Proficiency in Windows host forensics, memory analysis, and event log review.
• Experience presenting findings to senior stakeholders.
• Strong communication, judgement, and decision-making under pressure.
• Degree-level education in a relevant discipline or equivalent.
• Experience with insurer-led or legally privileged investigations.

Responsibilities

• Lead end-to-end incident response engagements involving ransomware, BEC, and ClickFix.
• Own forensic investigations across Windows environments, AD, M365, Azure, and endpoints.
• Produce executive and technical reports detailing root cause, attacker activity, and business impact.
• Advise on containment strategies, recovery planning, and security improvements during live incidents.
• Mentor consultants and analysts to raise team capability.
• Develop and enhance forensic tooling, playbooks, timelines, and MITRE ATT&CK-aligned methods.
• Collaborate with pre-sales and BD for scoping discussions and client proposals.

Skills

Leadership

DFIR expertise

Communication

Judgement under pressure

Client-facing presentation

Education

Degree-level education in a relevant discipline

Tools

GCFA

GCFE

GCIH

GNFA

GREM

CREST CCIM

CRIA

Microsoft 365

Google Workspace investigations

Windows forensics

MITRE ATT&CK

Job description

Zensec is one of the UK's fastest-growing cyber security providers. As part of the award-winning Zenzero Group, recognised as a Top 8 Technology Company at the British Business Awards 2026, a Deloitte Best Managed Company, and featured in the Sunday Times Hundred in both 2025 and 2026, we're helping ambitious organisations strengthen their security posture in an increasingly complex digital world.

Our mission is simple: to make cyber security practical, proactive, and effective for mid-market businesses. From managed detection and response, security operations, and threat monitoring to governance, risk, compliance, and security consulting, we help organisations stay secure, resilient, and ready for what's next.

Demand for cyber security expertise has never been greater, and neither has our ambition. As a certified B Corp and Scale Up Award winner, we believe high growth and high standards go hand in hand. We're building a business where talented people can do meaningful work, make a real impact, and help shape the future of cyber security.

Fast growth. High standards. Real impact. If that sounds like your kind of place, we'd love to hear from you.

About the Role

As a Principal Security Consultant, you will lead high-impact digital forensics and incident response (DFIR) engagements for clients facing some of today's most challenging cyber threats, including ransomware, business email compromise (BEC), and ClickFix attacks. Acting as the senior technical lead throughout the incident lifecycle, you will guide investigations from initial triage through containment, forensic analysis, recovery, and final reporting.

Working within the DFIR Forensics team, you will collaborate with incident managers, SOC specialists, account teams, insurers, legal partners, and client leadership. This is an opportunity to shape investigation methodology, strengthen tooling, mentor consultants, and influence the development of a growing cyber security practice.

Success in this role means delivering exceptional client outcomes, providing trusted technical leadership during live incidents, developing team capability, and continuously improving forensic processes and services.

Job requirements

• Proven ability to lead complex DFIR investigations and manage client-facing incident response engagements.
• Deep understanding of ransomware intrusion lifecycles and adversary tradecraft.
• Strong expertise in Microsoft 365 and BEC investigations, including audit log analysis and identity compromise scenarios.
• Advanced knowledge of Windows host forensics, evidence collection, event log analysis, and memory analysis techniques.
• Experience presenting technical findings and recommendations to senior stakeholders.
• Strong communication, judgement, and decision-making skills under pressure.
• Degree-level education in a relevant discipline or equivalent practical experience.
• Experience supporting insurer-led or legally privileged investigations.
• Experience within an NCSC CIR Enhanced organisation.
• Knowledge of Google Workspace investigations.
• Industry certifications such as GCFA, GCFE, GCIH, GNFA, GREM, CREST CCIM, or CRIA.

Job responsibilities

• Lead end-to-end incident response engagements involving ransomware, BEC, and ClickFix attacks.
• Own forensic investigations across Windows environments, Active Directory, Microsoft 365, Azure, and endpoint platforms.
• Drive the production of executive-level and technical reports that clearly communicate root cause, attacker activity, and business impact.
• Advise clients on containment strategies, recovery planning, and security improvement actions during live incidents.
• Mentor and coach consultants and analysts, raising technical capability across the DFIR team.
• Build and enhance forensic tooling, playbooks, investigation timelines, and MITRE ATT&CK-aligned methodologies.
• Partner with pre-sales and business development teams to support scoping discussions and client proposals.
• Private health insurance
• Generous holiday allowance + a day off on your birthday
• Enhanced pension contributions
• Regular social events across all our offices