Senior Dfir Investigator

Cfc; Greater London; Hybrid; GBP 85,000 - 120,000; Full time

Job summary

CFC in London is seeking a Senior DFIR Investigator to join our Global Security Services team. You will lead complex investigations for clients worldwide, containing threats and helping organisations recover with confidence.

This role is a hybrid, permanent position offering exposure to sophisticated cyber incidents and collaboration with a broad range of stakeholders. You will mentor junior investigators and contribute to client training and proactive services.

Qualifications

• Experience leading DFIR investigations in enterprise environments.
• Strong capability across host, network and cloud forensics.
• Proven ability to translate technical findings into business-focused outcomes.
• Excellent stakeholder communication and report-writing skills.

Responsibilities

• Lead forensic investigations across host, network and cloud environments to identify root cause, scope and impact of cyber incidents.
• Analyse threat actor activity, attack techniques, malware and potential data exposure.
• Produce high-quality forensic reports, attack timelines and actionable recommendations for clients.
• Deploy and utilise incident response tooling to collect, preserve and analyse forensic evidence.
• Provide trusted technical guidance to clients throughout the incident response lifecycle.
• Work closely with internal teams including Cyber Claims, Underwriting and Security Services, as well as external legal, technology and client stakeholders.
• Lead smaller investigation teams and support the successful delivery of incident response engagements.
• Mentor and develop junior investigators, contributing to the continued growth of the team.
• Deliver proactive cyber services, including tabletop exercises, workshops and client-facing training.
• Maintain expertise across emerging threats, attack techniques and industry best practice.

Skills

Digital forensics

Incident response

Host forensics

Network forensics

Malware analysis

Threat TTPs

Client-facing reporting

Mentoring juniors

Job description

Senior DFIR Investigator

At CFC, cyber sits at the core of our business. Through our in-house cyber expertise and market-leading insurance solutions, we help organisations respond to, recover from and build resilience against cyber threats.

We're seeking a Senior DFIR Investigator to join our Global Security Services team. Working at the forefront of incident response, you'll lead complex investigations for organisations around the world, helping clients understand what happened, contain threats and recover with confidence.

This role offers the opportunity to work on sophisticated cyber incidents, collaborate with a broad range of stakeholders, and play a key role in shaping outcomes for clients during critical moments.

Department: Global Security Services
Employment Type: Permanent - Full Time
Location: UK - London
Workplace type: Hybrid
Reporting To: John Woolcott

Key Responsibilities

• Lead forensic investigations across host, network and cloud environments to identify root cause, scope and impact of cyber incidents.
• Analyse threat actor activity, attack techniques, malware and potential data exposure.
• Produce high-quality forensic reports, attack timelines and actionable recommendations for clients.
• Deploy and utilise incident response tooling to collect, preserve and analyse forensic evidence.
• Provide trusted technical guidance to clients throughout the incident response lifecycle.
• Work closely with internal teams including Cyber Claims, Underwriting and Security Services, as well as external legal, technology and client stakeholders.
• Lead smaller investigation teams and support the successful delivery of incident response engagements.
• Mentor and develop junior investigators, contributing to the continued growth of the team.
• Deliver proactive cyber services, including tabletop exercises, workshops and client-facing training.
• Maintain expertise across emerging threats, attack techniques and industry best practice.

Skills, Knowledge and Expertise

You'll be an experienced DFIR professional with a strong technical background and a track record of leading investigations in complex environments. You are comfortable operating in high-pressure situations, communicating clearly with a range of stakeholders, and translating technical findings into meaningful business outcomes.

You'll ideally bring:

• Significant experience in digital forensics and incident response within enterprise environments.
• Expertise across host, network and application forensics.
• Experience investigating complex cyber incidents from initial response through to reporting and remediation.
• Strong understanding of threat actor tactics, techniques and procedures (TTPs).
• Hands-on experience with forensic and incident response tooling.
• Familiarity with malware investigation and compromised system analysis.
• Knowledge of enterprise infrastructure, including networks, endpoints and cloud environments.
• Experience producing client-facing reports and presenting findings to both technical and non-technical audiences.
• Strong stakeholder management and communication skills.