Senior DFIR Incident Response Lead (Remote)

Forensic Focus; Greater London; Hybrid; GBP 69,000 - 115,000; Full time

Job summary

Hays is seeking an Incident Response Manager/DFIR Manager for a remote-first role based in London. The position combines hands-on technical delivery (≈70%) with team leadership (≈30%), handling high-profile investigations and coordinating with clients, legal advisers and insurers.

The role requires experience across full-lifecycle incident response, evidence preservation, and advanced forensic tooling, with Magnet AXIOM being advantageous. Weekend on-call and some travel may be required.

Qualifications

• Proven experience managing full-lifecycle incident-response engagements.
• Strong knowledge of evidence preservation and chain-of-custody requirements.
• Experience delivering tabletop exercises and working with legal/insurance stakeholders.

Responsibilities

• Lead ransomware and business email compromise investigations.
• Oversee endpoint, cloud and on-prem forensic activity.
• Act as senior escalation point during live incidents.
• Communicate findings to clients, legal advisers and cyber insurers.

Skills

Incident response

DFIR

Leadership

Client-facing

Tabletop exercises

Forensic tooling

Project management

Tools

Magnet AXIOM

Job description

Hays is seeking an Incident Response Manager/DFIR Manager for a remote-first role based in London. The position combines hands-on technical delivery (≈70%) with team leadership (≈30%), handling high-profile investigations and coordinating with clients, legal advisers and insurers.

The role requires experience across full-lifecycle incident response, evidence preservation, and advanced forensic tooling, with Magnet AXIOM being advantageous. Weekend on-call and some travel may be required.