Senior Incident Responder (DFIR)

TN United Kingdom; Welwyn Garden City; On-site; GBP 45,000 - 80,000; Full time

Job summary

An established industry player is seeking a skilled Cybersecurity Incident Responder to join their Digital Forensics and Incident Response team. This senior role involves investigating security incidents, enhancing technical workflows, and leading threat hunts to protect against evolving threats. You'll collaborate with various teams to drive innovation in detection and response capabilities. With a focus on critical thinking and technical expertise, you'll play a pivotal role in safeguarding the organization's diverse digital landscape. Join a company that values diversity and offers a comprehensive benefits package, ensuring you thrive both personally and professionally.

Benefits

Annual bonus scheme of up to 20%

25 days of holiday plus personal day

Private medical insurance

26 weeks maternity leave at full pay

Free 24/7 virtual GP service

Employee Assistance Programme

Qualifications

• 4+ years of experience in cybersecurity incident response.
• Proficiency in forensic analysis across various OS.
• Experience with security technologies like EDR and SIEM.

Responsibilities

• Perform forensic analysis to understand security incidents.
• Support incident managers with root cause analysis.
• Lead threat hunts to uncover anomalous behavior.

Skills

Cybersecurity Incident Response

Forensic Analysis

Python

PowerShell

Critical Thinking

Incident Handling

Education

Bachelor's Degree in Computer Science or related field

Tools

EDR

SOAR

SIEM

Microsoft Azure

Job description

Social network you want to login/join with:

col-narrow-left

Client:

Location:

Job Category:

Other

-

EU work permit required:

Yes

col-narrow-right

Job Reference:

1a339c4c5afd

Job Views:

4

Posted:

02.05.2025

Expiry Date:

16.06.2025

col-wide

Job Description:

Tesco UK • Welwyn Garden City • Full-Time • Apply by 23-May-2025

About the role

Our Digital Forensics and Incident Response (DFIR) team leads the technical investigation and response to security incidents at Tesco. As part of this team, you’ll work alongside our security operations, threat intelligence, and security engineering teams to protect, detect, and respond to security threats across Tesco’s diverse and evolving estate.

You’ll apply your deep technical knowledge and critical thinking ability to investigate and understand the full extent of security incidents and threats. Your ability to distil and clearly convey technical information will allow you to provide the key contextual information to decision makers that enables them to make informed decisions.

As a senior position, when you’re not investigating security incidents, you’ll have the freedom to leverage your knowledge and real-world experience to help improve and automate the team’s technical workflows, working alongside other teams to help drive innovation across our prevention, automation, detection, and response capabilities. Your status as a senior incident responder means you’ll serve as a role model for engineers and analysts across Security Operations.

What is in it for you

We’re all about the little helps. That’s why we make sure our Tesco colleague benefits package takes care of you – both in and out of work. To find out more!

• Annual bonus scheme of up to 20% of base salary
• Holiday starting at 25 days plus a personal day (plus Bank holidays)
• Private medical insurance
• 26 weeks maternity and adoption leave (after 1 year's service) at full pay, followed by 13 weeks of Statutory Maternity Pay or Statutory Adoption Pay, and 4 weeks fully paid paternity leave
• Free 24/7 virtual GP service, Employee Assistance Programme (EAP) for you and your family, free access to a range of experts to support your mental wellbeing

You will be responsible for

• Investigation and Response: Perform host, network, and cloud-based forensic analysis to understand the full extent of security incidents and take appropriate response actions to contain, remediate, and recover.
• Incident Handling: Support cyber-security incident managers and decision makers with root cause analysis and formulating recommendations for detection and prevention controls.
• Technical Project Work: Use your technical capabilities to enhance our existing processes as well as identifying and working on new methods to deliver DFIR services to the ever-changing technology requirements of the business.
• Threat Hunting & Detection Engineering: Lead intelligence-based threat hunts to uncover anomalous behaviour in our estate that is relevant to Tesco, testing and raising potential detections to contribute to our internal detection engineering programme.

You will need

• 4+ years of relevant experience.
• Experience with responding to security incidents in large-scale corporate on-premises and public cloud environments (preferably Microsoft Azure).
• Experience with forensic analysis of cybersecurity incidents on Windows, MacOS, and Unix operating systems and an in-depth understanding of those operating systems.
• Experience with a broad range of security technologies such as EDR, SOAR, and SIEM.
• Proficiency in at least one programming or scripting language: Python or PowerShell.
• Ability to think critically and lead technical investigations.
• Ability to handle high-pressure situations in a calm, productive, and professional manner.
• Experience with static and dynamic file/malware triage is desirable.

About us

Our vision at Tesco is to become every customer's favourite way to shop, whether they are at home or out on the move. Our core purpose is ‘Serving our customers, communities and planet a little better every day’. Serving means more than a transactional relationship with our customers. It means acting as a responsible and sustainable business for all stakeholders, for the communities we are part of, and for the planet. We are proud to have an inclusive culture at Tesco where everyone truly feels able to be themselves. We celebrate diversity and recognize the value and opportunity it brings. We’re committed to creating a workplace where differences are valued, and all colleagues are given equal opportunities.