Senior DFIR Lead: Cyber Operations & Forensics

Cyber UK; United Kingdom; Remote; GBP 120,000 - 180,000; Full time

Job summary

Barclays is seeking an experienced DFIR Lead Cyber Operations Analyst, a VP-level role based in Knutsford (Radbroke Hall). You will lead advanced digital forensics and incident response, analyse malware and network activity, and produce clear, high-quality reporting for senior stakeholders in a fast-paced, high-pressure environment.

You will manage security monitoring, threat detection, and incident resolution, with on-call rotations and occasional extended hours.

Qualifications

• Digital forensics and incident response expertise, including host, network, cloud and live forensic analysis, supported by rigorous documentation practices.
• Excellent written and verbal communication skills, with the ability to clearly articulate complex technical findings to senior stakeholders and non-technical business teams.
• Proven leadership under pressure, including coordinating investigations, managing cross-functional stakeholders, and operating effectively within a regulated banking environment.
• Cloud investigation experience across AWS, Azure, or Google Cloud.
• Scripting and automation capabilities, using Python, PowerShell, Bash, or JavaScript.
• Relevant industry certifications, such as GCFA, GNFA, GCFE, or GREM.

Responsibilities

• Management of security monitoring systems, including intrusion prevention and detection, to alert, detect and block potential cyber security incidents, and provide a prompt response to restore normal operations with minimal damage.
• Identification of emerging cyber security threats, attack techniques and technologies to detect/prevent incidents, and collaborate with networks to gain industry knowledge.
• Management and analysis of security information and event management systems to collect, correlate and analyse security logs, events and alerts.
• Triage of data loss prevention alerts to identify and prevent sensitive data exfiltration.
• Management of cyber security incidents including remediation and driving to closure.

Skills

Digital forensics

Incident response

Leadership under pressure

Technical reporting

Communication skills

Tools

Python

PowerShell

Bash

JavaScript

Job description

Barclays is seeking an experienced DFIR Lead Cyber Operations Analyst, a VP-level role based in Knutsford (Radbroke Hall). You will lead advanced digital forensics and incident response, analyse malware and network activity, and produce clear, high-quality reporting for senior stakeholders in a fast-paced, high-pressure environment.

You will manage security monitoring, threat detection, and incident resolution, with on-call rotations and occasional extended hours.