Security Consultant - Incident Response Analyst

NTT DATA; Greater London; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

NTT DATA is seeking a Security Consultant / Incident Responder (SOC/DFIR) in London with flexible remote working. You will detect, triage, investigate and coordinate resolution of cyber security incidents across UK and EMEA, combining threat hunting, digital forensics and incident management.

You will work with IT, risk, legal and third-party stakeholders, contribute to playbooks, detection engineering and management reporting, and support governance through metrics and post-incident reviews.

Qualifications

• Practical experience in cyber incident response, security monitoring or a SOC environment.
• Hands-on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
• Experience with incident response lifecycle activities including preparation, detection, analysis, containment, eradication, recovery and lessons learned.
• Experience producing incident records, investigation reports, management updates and post-incident findings.
• Understanding of attacker behaviours and frameworks including MITRE ATT&CK, Cyber Kill Chain and NIST incident response guidance.

Responsibilities

• Incident Detection, Triaging and Response: monitor alerts across SIEM/EDR, triage incidents and determine severity.
• Digital Forensics and Investigation: collect and analyse artefacts to establish scope and root cause.
• Threat Hunting and Detection Improvement: develop and validate hunting hypotheses and detection content.
• Incident Response Capability and Governance: develop plans, runbooks and post-incident reviews.
• Maintain incident records and provide updates to stakeholders.

Skills

Cyber incident response

Security monitoring

SIEM expertise

Windows artefacts analysis

Linux artefacts analysis

Incident response lifecycle

Report writing

Stakeholder communication

Threat hunting

Forensics

MITRE ATT&CK knowledge

Cloud security investigation

Evidence handling/regulatory

PowerShell/Python/KQL scripting

Education

Bachelor’s degree in cyber security or computer science

Relevant certifications (GCIH, GCIA, GCFA, GNFA, SC-200, CySA+, CISSP) desirable

Tools

EnCase

FTK

Velociraptor

Volatility

Wireshark

Job description

Security Consultant / Incident Responder (SOC/DFIR)

UK Security Practice | London with flexible remote working | Specialist

Role summary

The Incident Response Analyst is a key member of the Cyber Security Incident Response function, responsible for detecting, triaging, investigating, containing and coordinating the resolution of cyber security incidents across UK and EMEA. The role combines security monitoring, incident handling, threat hunting and digital forensics to reduce business impact, preserve evidence and improve organisational resilience.

The job holder will work with technology, business, risk, legal, compliance and third-party stakeholders throughout the incident lifecycle. The role will also contribute to playbooks, detection engineering, threat intelligence integration, post-incident reviews and management reporting.

Core responsibilities

What you'll be doing;

Incident Detection, Triage and Response

• Monitor and analyse alerts from SIEM, EDR/XDR, identity, email, cloud, network and other security controls to identify suspicious or malicious activity.
• Triage alerts, validate incidents, determine severity and business impact, and elevate in line with the incident response process and defined service levels.
• Lead or support investigations into internal and external threats, including phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity.
• Coordinate containment, eradication and recovery activities with infrastructure, application, identity, cloud and business teams, maintaining clear ownership and decision records.
• Maintain accurate incident case records, investigation timelines, evidence, actions, decisions and closure rationale from initial detection through to resolution.
• Provide timely incident updates and concise technical and management reports, including material facts, impact, risk, actions, dependencies and next steps.

Digital Forensics and Investigation

• Collect, preserve and analyse endpoint, server, identity, network, email and cloud artefacts in accordance with approved forensic and evidence-handling procedures.
• Perform host and network analysis using logs, packet captures, forensic images and security telemetry to establish scope, root cause, attacker activity and affected assets.
• Identify indicators of compromise, tactics, techniques and procedures, and map findings to MITRE ATT&CK where appropriate.
• Support legally or regulatorily sensitive investigations by maintaining evidence integrity, chain of custody and appropriate access controls.
• Engage specialist internal or external forensic support where the complexity, scale or sensitivity of an incident requires additional expertise.

Threat Hunting and Detection Improvement

• Develop and execute hypothesis-led threat hunts using threat intelligence, environmental knowledge and observed attacker behaviours.
• Create, tune and validate monitoring use cases, correlation rules, queries, custom indicators and detection content to improve coverage and reduce false positives.
• Assess detection gaps identified during incidents and recommend enhancements to logging, telemetry, processes and security controls.
• Contribute to purple-team, penetration-testing and control-validation activities and ensure relevant findings are converted into actionable detection or response improvements.

Incident Response Capability and Governance

• Develop, maintain and exercise incident response plans, standard operating procedures, playbooks, call-out arrangements and stakeholder communication templates.
• Conduct post-incident reviews and root-cause analysis, track lessons learned and ensure agreed corrective actions are assigned and monitored to closure.
• Contribute to incident response metrics, key risk indicators, trend analysis and control-effectiveness reporting for management and governance forums.
• Support cyber exercises and simulations to validate roles, escalation paths, communications and decision-making under realistic incident conditions.
• Keep current with emerging threats, vulnerabilities, attack methods and changes to relevant industry frameworks and regulatory expectations.

What you'll bring;

• Practical experience in cyber incident response, security monitoring or a Security Operations Centre environment.
• Hands-on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
• Working knowledge of incident response lifecycle activities including preparation, detection, analysis, containment, eradication, recovery and lessons learned.
• Experience producing incident records, investigation reports, management updates and post-incident findings.
• Understanding of attacker behaviours and frameworks including MITRE ATT&CK, Cyber Kill Chain and NIST incident response guidance.
• Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint security, vulnerability management and data loss prevention.
• Ability to manage multiple priorities, exercise sound judgement under pressure and communicate clearly with technical and senior stakeholders.
• Awareness of evidence handling, forensic integrity, confidentiality and regulatory considerations relevant to cyber investigations.
• Experience in banking, financial services or another regulated environment.
• Experience with threat intelligence, malware analysis, scripting or automation using PowerShell, Python, KQL or similar languages.
• Experience developing detection rules, response playbooks, threat hunts or security orchestration and automation workflows.
• Knowledge of Microsoft security technologies such as Sentinel, Defender XDR, Defender for Identity and Defender for Cloud, or equivalent platforms.
• Exposure to forensic tools such as EnCase, FTK, Velociraptor, Volatility, Wireshark or equivalent.
• Understanding of cloud investigation techniques across Microsoft Azure, Microsoft 365 or other major cloud platforms.
• Must meet eligibility requirements for UK Security Check clearance.

Qualifications

• Relevant professional experience supported by a degree in cyber security, computer science or a related discipline, or equivalent practical experience.
• One or more relevant certifications such as GCIH, GCIA, GCFA, GNFA, SC-200, CySA+, CISSP or equivalent are desirable.
• Sound knowledge of information security principles, recognised standards and regulatory expectations, including NIST, CIS Controls and relevant privacy requirements.