Security Consultant – Incident Responder (SOC/DFIR)

NTT DATA; Greater London; On-site; GBP 60,000 - 90,000; Full time

Job summary

Forensic Focus in the United Kingdom seeks a seasoned SOC/IR professional to monitor alerts, triage incidents, and perform digital forensics across endpoints, networks and cloud. The role emphasizes hands-on investigation within a consultancy setting serving UK & EMEA clients.

You will contribute to threat hunting, detection engineering, playbook development and post-incident reviews, collaborating across teams to improve detection capabilities and incident response governance.

Qualifications

• Experience with SIEM, EDR/XDR, and cloud security tools.
• Experience in forensic evidence handling and log/packet analysis.
• Ability to map findings to MITRE ATT&CK and contribute to threat intelligence and detection tuning.

Responsibilities

• Monitor security alerts, triage and investigate incidents.
• Coordinate containment and recovery actions to minimize impact.
• Conduct digital forensics on endpoints, networks and cloud systems.
• Contribute to threat hunting, detection engineering, playbook development and post-incident reviews.

Skills

SIEM experience

EDR/XDR experience

Log analysis

Packet analysis

Threat hunting

IR governance

Playbook development

Cross-team coordination

Tools

SIEM tools

EDR/XDR tools

Network security tools

Cloud security tools

Forensic tools

Job description

The Role

This position involves monitoring security alerts, triaging and investigating incidents, coordinating containment and recovery, and conducting digital forensics on endpoints, networks and cloud systems. The analyst also contributes to threat hunting, detection engineering, playbook development and post-incident reviews.

Skills & Experience

Candidates need experience with SIEM, EDR/XDR, network and cloud security tools, forensic evidence handling, log and packet analysis, and mapping findings to MITRE ATT&CK. Familiarity with threat intelligence, detection tuning and incident response governance is expected.

Who It Suits

Suited to experienced SOC or incident response professionals who enjoy hands-on investigation, cross-team coordination, and improving detection capability within a consultancy environment across UK and EMEA organisations.