Senior DFIR Lead: Incident Response & Forensics

LT Harper Group; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

LT Harper Group in London is seeking a Senior Digital Forensics and Incident Response Consultant to lead forensic engagements and guide the cyber response practice. You will work with law firms, Fortune 500 multinationals and government clients, shaping capabilities across EMEA.

You will manage incident response from collection through reporting, perform cross-platform investigations (Windows/Linux, on‑prem and cloud), and mentor junior staff while developing proposals and project plans.

Qualifications

• Extensive experience leading cyber incidents requiring forensic response, including crisis scenarios.
• Strong grounding in forensic best practices and evidence handling (NPCC, NIST, SANS) and tools like EnCase, Nuix, Axiom or Blackbag.
• Hands-on log analysis using PowerShell, Bash, Python and SQL.

Responsibilities

• Lead forensic incident response engagements from evidence collection through to analysis and reporting.
• Investigate cyber incidents across Microsoft and Linux environments, on-premise and in Microsoft 365, Azure and AWS.
• Keep all work defensible and to an evidential standard, with detailed contemporaneous notes.
• Support colleagues in Cyber Response, Investigations and Technical Consulting, including eDiscovery and data analytics work.
• Turn enquiries into proposals, estimates and project plans, and build your profile as a recognised subject matter expert.
• Coach and develop other members of the team.

Skills

Incident response

Forensic analysis

Team leadership

PowerShell

Python

Communication

Cloud (Azure/AWS)

Evidence handling

Education

Certifications such as EnCE, GCFA or CISSP

Tools

EnCase

Nuix

Axiom

Blackbag

Job description

LT Harper Group in London is seeking a Senior Digital Forensics and Incident Response Consultant to lead forensic engagements and guide the cyber response practice. You will work with law firms, Fortune 500 multinationals and government clients, shaping capabilities across EMEA.

You will manage incident response from collection through reporting, perform cross-platform investigations (Windows/Linux, on‑prem and cloud), and mentor junior staff while developing proposals and project plans.