Senior DFIR Incident Response Lead – Hybrid

Forensic Focus Limited; United Kingdom; On-site; GBP 90,000 - 110,000; Full time

Job summary

Forensic Focus Limited is seeking an Incident Response Lead (DFIR) to oversee a portfolio of live incidents end-to-end within a cyber consultancy context. The role combines leadership with hands-on digital forensics across disk, memory, network traffic and log data, with on-call duties and occasional travel.

The ideal candidate has deep DFIR experience, proficiency with X-Ways, EnCase, FTK, AXIOM or Cellebrite, and strong analytics across networks, memory forensics and malware reverse

Qualifications

• Significant experience managing complex cyber incidents.
• Strong forensic competency with common DFIR toolsets (X-Ways, EnCase, FTK, AXIOM, Cellebrite).
• Technical depth in network/log analysis, memory forensics, and malware reverse engineering or mobile forensics.

Responsibilities

• Lead end-to-end incident response engagements within a cyber consultancy's practice.
• Oversee scoping, triage, containment, evidence preservation and recovery.
• Conduct and quality-assure digital forensics across disk, memory, network traffic and logs.
• Manage on-call rotation and occasional short-notice travel.

Job description

Forensic Focus Limited is seeking an Incident Response Lead (DFIR) to oversee a portfolio of live incidents end-to-end within a cyber consultancy context. The role combines leadership with hands-on digital forensics across disk, memory, network traffic and log data, with on-call duties and occasional travel.

The ideal candidate has deep DFIR experience, proficiency with X-Ways, EnCase, FTK, AXIOM or Cellebrite, and strong analytics across networks, memory forensics and malware reverse