Senior DFIR Lead: Incident Response, Forensics & Automation

Tesco UK; Greater London; Hybrid; GBP 75,000 - 110,000; Full time

Job summary

Tesco UK is seeking a Senior Incident Responder in Digital Forensics and Incident Response (DFIR) to lead investigations across Tesco's security estate. You will work with security operations, threat intel, and security engineering to protect, detect, and respond to security threats across Tesco’s diverse estate.

You will drive automation and improved workflows, mentoring engineers while shaping detection engineering for the business.

Qualifications

• 4+ years of relevant DFIR experience.
• Experience responding to security incidents in large-scale corporate on-prem and cloud (Azure).
• Forensic analysis of Windows, MacOS, Unix.
• Static and dynamic analysis of suspicious scripts and executables.
• Experience with EDR, SOAR, and SIEM.
• Ability to lead technical investigations under pressure.
• Proficiency in at least one programming or scripting language.

Responsibilities

• Perform host, network, and cloud forensics to contain, remediate, and recover.
• Support incident managers with root cause analysis and recommendations.
• Enhance processes and develop new DFIR methods for changing tech requirements.
• Lead threat hunts and raise detections for Tesco's estate.

Skills

Incident response

Azure experience

Forensic analysis

Static analysis

Dynamic analysis

EDR/SOAR/SIEM

Programming/scripting

Leadership under pressure

Critical thinking

Job description

Tesco UK is seeking a Senior Incident Responder in Digital Forensics and Incident Response (DFIR) to lead investigations across Tesco's security estate. You will work with security operations, threat intel, and security engineering to protect, detect, and respond to security threats across Tesco’s diverse estate.

You will drive automation and improved workflows, mentoring engineers while shaping detection engineering for the business.