Senior DFIR Analyst - Incident Response & Forensics

Pen Test Partners; England; Remote; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Private Medical Insurance

Group pension

Training & conference funding

EV salary sacrifice

Job summary

Pen Test Partners is seeking an experienced DFIR Analyst to join our growing team. This role combines hands-on incident response with client-facing advisory work, onboarding retainer clients and responding to live incidents across endpoints, cloud, and networks.

You will lead investigations end-to-end, build timelines, produce structured reports, and act as a trusted advisor during high-pressure incidents, with remote work and occasional client-site travel.

Qualifications

• Proven experience (typically 5+ years) in incident response, SOC operations, cybersecurity consulting.
• Ability to lead investigations and make decisions under pressure.
• Strong experience producing IR reports, documentation and playbooks for enterprises.
• Familiarity with cloud-based and on-premise environments.

Responsibilities

• Onboard and lead DFIR retainer clients, validate access, tooling, logging, and response readiness.
• Respond to live cyber incidents (ransomware, BEC, account compromise, cloud attacks).
• Conduct compromise assessments across endpoints, cloud and network data sources.
• Perform forensic acquisition and analysis; document evidence to a defensible standard.
• Build timelines and correlate artefacts across multiple data sources.
• Lead containment and eradication activities and validate recovery actions.
• Produce clear IR reports with timelines, root cause and recommendations.
• Define investigation strategy, hypotheses and evidence collection plans.

Skills

Incident response

SOC operations

Cybersecurity consulting

Investigation leadership

IR reporting

Cloud & on-prem environments

Independent working

Tools

EDR platforms

SIEM tooling

Forensic tools

Job description

Pen Test Partners is seeking an experienced DFIR Analyst to join our growing team. This role combines hands-on incident response with client-facing advisory work, onboarding retainer clients and responding to live incidents across endpoints, cloud, and networks.

You will lead investigations end-to-end, build timelines, produce structured reports, and act as a trusted advisor during high-pressure incidents, with remote work and occasional client-site travel.