Senior DFIR Consultant

LT Harper Recruitment Group; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

Forensic Focus seeks an experienced senior consultant to lead end-to-end forensic incident response engagements across mixed environments. You will handle evidence collection, analysis and reporting while interfacing with clients and supporting eDiscovery and investigations teams.

The role requires on-call availability, travel, and the ability to mentor junior staff, with strong communication to technical teams and senior stakeholders in crisis situations.

Qualifications

• Proven DFIR leadership experience in incident response engagements.
• Strong evidence handling practices aligned with NPCC/NIST/SANS.
• Scripting ability in PowerShell, Bash, Python and SQL; relevant certifications are advantageous.

Responsibilities

• Lead forensic incident response engagements end-to-end from collection to reporting.
• Engage with clients, contribute to proposals, and support eDiscovery and investigations teams.
• Maintain on-call availability and travel as required.

Skills

DFIR leadership

Evidence handling

PowerShell

Bash

Python

SQL

Client communication

Tools

EnCase

Nuix

Axiom

BlackBag

Job description

The Role

This senior consultant leads forensic incident response engagements end-to-end, from evidence collection through analysis and reporting across Microsoft, Linux, cloud and on-premise environments. The role includes client-facing work, proposal writing, and supporting eDiscovery and investigations teams, with on-call availability and travel.

Skills & Experience

Requires proven forensic incident response leadership, strong evidence handling practice (NPCC, NIST, SANS), and tools such as EnCase, Nuix, Axiom or Blackbag. Scripting skills in PowerShell, Bash, Python and SQL are needed, alongside certifications like EnCE, GCFA or CISSP being advantageous.

Who It Suits

Suited to an experienced DFIR professional comfortable leading engagements under pressure, mentoring junior staff, and communicating confidently with both technical teams and senior client stakeholders in crisis situations.