Senior DFIR Investigator

CFC; Royal Borough of Greenwich; On-site; GBP 90,000 - 120,000; Full time

Job summary

CFC is seeking a Senior DFIR Investigator to join their Global Security Services team in London. You will lead complex investigations across host, network and cloud environments and guide clients through containment, recovery and remediation.

The role emphasizes incident response leadership, collaboration with legal, underwriting and claims teams, and mentoring junior investigators while delivering proactive cyber services and client-facing training.

Qualifications

• Significant experience in digital forensics and incident response within enterprise environments.
• Hands-on experience with forensic and incident response tooling.
• Strong understanding of threat actor TTPs and malware investigation.

Responsibilities

• Lead forensic investigations across host, network and cloud environments to identify root cause, scope and impact of cyber incidents.
• Analyse threat actor activity, attack techniques, malware and potential data exposure.
• Produce high-quality forensic reports, attack timelines and actionable recommendations for clients.
• Deploy and utilise incident response tooling to collect, preserve and analyse forensic evidence.
• Provide trusted technical guidance to clients throughout the incident response lifecycle.
• Lead smaller investigation teams and mentor junior investigators.

Skills

DFIR expertise

Incident response

Mentoring

Stakeholder communication

Threat hunting

Tools

Forensic tooling

Job description

Senior DFIR Investigator

Department: Global Security Services

Employment Type: Permanent - Full Time

Location: UK - London

Reporting To: John Woolcott

Description

At CFC, cyber sits at the core of our business. Through our in-house cyber expertise and market-leading insurance solutions, we help organisations respond to, recover from and build resilience against cyber threats.

We're seeking a Senior DFIR Investigator to join our Global Security Services team. Working at the forefront of incident response, you'll lead complex investigations for organisations around the world, helping clients understand what happened, contain threats and recover with confidence.

This role offers the opportunity to work on sophisticated cyber incidents, collaborate with a broad range of stakeholders, and play a key role in shaping outcomes for clients during critical moments.

Key Responsibilities

• Lead forensic investigations across host, network and cloud environments to identify root cause, scope and impact of cyber incidents.
• Analyse threat actor activity, attack techniques, malware and potential data exposure.
• Produce high-quality forensic reports, attack timelines and actionable recommendations for clients.
• Deploy and utilise incident response tooling to collect, preserve and analyse forensic evidence.
• Provide trusted technical guidance to clients throughout the incident response lifecycle.
• Work closely with internal teams including Cyber Claims, Underwriting and Security Services, as well as external legal, technology and client stakeholders.
• Lead smaller investigation teams and support the successful delivery of incident response engagements.
• Mentor and develop junior investigators, contributing to the continued growth of the team.
• Deliver proactive cyber services, including tabletop exercises, workshops and client-facing training.
• Maintain expertise across emerging threats, attack techniques and industry best practice.

Skills, Knowledge and Expertise

You will be an experienced DFIR professional with a strong technical background and a track record of leading investigations in complex environments. You are comfortable operating in high-pressure situations, communicating clearly with a range of stakeholders, and translating technical findings into meaningful business outcomes.

You’ll ideally bring:

• Significant experience in digital forensics and incident response within enterprise environments.
• Expertise across host, network and application forensics.
• Experience investigating complex cyber incidents from initial response through to reporting and remediation.
• Strong understanding of threat actor tactics, techniques and procedures (TTPs).
• Hands-on experience with forensic and incident response tooling.
• Familiarity with malware investigation and compromised system analysis.
• Knowledge of enterprise infrastructure, including networks, endpoints and cloud environments.
• Experience producing client-facing reports and presenting findings to both technical and non-technical audiences.
• Strong stakeholder management and communication skills.
• Experience mentoring, coaching or leading other investigators.

Knowledge of industry frameworks and standards, including NIST and ISO, alongside an understanding of legal and regulatory considerations associated with cyber incidents, would be advantageous.

At CFC, you'll join a team of cyber specialists focused on delivering market-leading expertise, supporting clients through some of their most challenging moments, and helping organisations build greater cyber resilience.

Core Values

Love what you do:
We show up each day ready to take on the world. Our passion and intensity set us apart and makes the difference to our colleagues, customers, brokers and carriers.

Challenge everything:
We're never afraid to question the way that things are done and we constantly challenge ourselves and others to makes things better.

Have fun, be good:
Insurance is a serious business, but we don't take ourselves too seriously. We make it fun to work at CFC, we welcome all viewpoints, and we treat everyone how we would expect to be treated.