Senior DFIR Consultant

LT Harper Recruitment Group; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

LT Harper Group in London is seeking a Senior Digital Forensics and Incident Response Consultant to lead forensic engagements and guide the cyber response practice. You will work with law firms, Fortune 500 multinationals and government clients, shaping capabilities across EMEA.

You will manage incident response from collection through reporting, perform cross-platform investigations (Windows/Linux, on‑prem and cloud), and mentor junior staff while developing proposals and project plans.

Qualifications

• Extensive experience leading cyber incidents requiring forensic response, including crisis scenarios.
• Strong grounding in forensic best practices and evidence handling (NPCC, NIST, SANS) and tools like EnCase, Nuix, Axiom or Blackbag.
• Hands-on log analysis using PowerShell, Bash, Python and SQL.

Responsibilities

• Lead forensic incident response engagements from evidence collection through to analysis and reporting.
• Investigate cyber incidents across Microsoft and Linux environments, on-premise and in Microsoft 365, Azure and AWS.
• Keep all work defensible and to an evidential standard, with detailed contemporaneous notes.
• Support colleagues in Cyber Response, Investigations and Technical Consulting, including eDiscovery and data analytics work.
• Turn enquiries into proposals, estimates and project plans, and build your profile as a recognised subject matter expert.
• Coach and develop other members of the team.

Skills

Incident response

Forensic analysis

Team leadership

PowerShell

Python

Communication

Cloud (Azure/AWS)

Evidence handling

Education

Certifications such as EnCE, GCFA or CISSP

Tools

EnCase

Nuix

Axiom

Blackbag

Job description

Senior Digital Forensics and Incident Response Consultant

When a client faces a serious cyber incident, you’ll be the technical lead they rely on. You’ll join the London forensics team of a global risk consultancy, leading critical incident response engagements for law firms, Fortune 500 multinationals and government and law enforcement clients. You’ll also help shape how its forensic and cyber response capability develops across EMEA.

The essentials

• London, permanent, full time
• Senior level, reporting to an Associate Director or Director, DFIR
• On-call for short-notice matters, with up to 25% international travel

What you’ll actually do

• Lead forensic incident response engagements from evidence collection through to analysis and reporting
• Investigate cyber incidents across Microsoft and Linux environments, on-premise and in Microsoft 365, Azure and AWS
• Keep all work defensible and to an evidential standard, with detailed contemporaneous notes
• Support colleagues in Cyber Response, Investigations and Technical Consulting, including eDiscovery and data analytics work
• Turn enquiries into proposals, estimates and project plans, and build your profile as a recognised subject matter expert
• Coach and develop other members of the team

What you’ll need

• Proven experience leading cyber incidents that needed a forensic response, including clients in crisis
• Strong grounding in forensic best practice and evidence handling (NPCC, NIST, SANS) and tools such as EnCase, Nuix, Axiom or Blackbag
• Hands‑on log analysis using PowerShell, Bash, Python and SQL
• Clear written and spoken communication for technical and non-technical audiences
• Experience managing and developing other professionals

Nice to have

• Certifications such as EnCE, GIAC GCFA or CISSP
• Understanding of the EDRM (Electronic Discovery Reference Model)
• Background in cyber risk consulting, financial crime or compliance

What’s in it for you

• Direct responsibility on high-profile engagements from day one
• A real say in the direction of a global forensics and incident response offering
• Career development within a collaborative, inclusive international team