Senior Incident Responder (DFIR)

Tesco Technology; Welwyn Garden City; Hybrid; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Annual bonus up to 20% of base salary

Private medical insurance

Holidays 25 days + personal day + bank

Job summary

Tesco Technology seeks a senior Digital Forensics and Incident Response professional to lead investigations and drive proactive security across Tesco’s estate. You will work with security operations, threat intelligence, and engineering teams to detect, respond to incidents, and automate workflows.

You will mentor engineers, shape investigations, and leverage deep technical knowledge to deliver effective DFIR services across on-prem and cloud environments.

Qualifications

• 4+ years of relevant experience.
• Experience responding to security incidents in large-scale environments (on-prem & cloud).
• Forensic analysis of cyber-security incidents on Windows, MacOS, and Unix.

Responsibilities

• Perform host, network, and cloud-based forensic analysis to understand incidents and contain, remediate, and recover.
• Support incident managers with root cause analysis and recommendations for detections and prevention controls.
• Enhance existing processes and develop new methods to deliver DFIR services.
• Lead intelligence-based threat hunts to uncover anomalous behaviour and improve detections.

Skills

Incident response

Threat hunting

Forensic analysis

Programming/scripting

Tools

EDR

SOAR

SIEM

Job description

Our Digital Forensics and Incident Response (DFIR) team
lead the technical investigation and response to security incidents at Tesco.
As part of this team, you’ll work alongside our security operations, threat
intelligence, and security engineering teams to protect, detect, and respond to
security threats across Tesco’s diverse and evolving estate.

You’ll apply your deep technical knowledge and critical
thinking ability to investigate and understand the full extent of security incidents
and threats. Your ability to distil and clearly convey technical information
will allow you to provide the key contextual information to decision makers
that enables them to make informed decisions.

As a senior position, when you’re not investigating
security incidents, you’ll have the freedom to leverage your knowledge and real-world
experience to help improve and automate the team’s technical workflows, working
alongside other teams to help drive innovation across our prevention,
automation, detection and response capabilities. Your status as a senior
incident responder means you’ll serve as a role model for engineers and
analysts across Security Operations.

About the role

Our Digital Forensics and Incident Response (DFIR) team
lead the technical investigation and response to security incidents at Tesco.
As part of this team, you’ll work alongside our security operations, threat
intelligence, and security engineering teams to protect, detect, and respond to
security threats across Tesco’s diverse and evolving estate.

You’ll apply your deep technical knowledge and critical
thinking ability to investigate and understand the full extent of security incidents
and threats. Your ability to distil and clearly convey technical information
will allow you to provide the key contextual information to decision makers
that enables them to make informed decisions.

As a senior position, when you’re not investigating
security incidents, you’ll have the freedom to leverage your knowledge and real-world
experience to help improve and automate the team’s technical workflows, working
alongside other teams to help drive innovation across our prevention,
automation, detection and response capabilities. Your status as a senior
incident responder means you’ll serve as a role model for engineers and
analysts across Security Operations.

You will be responsible for

• § Investigation and Response: Perform host,
  network, and cloud-based forensic analysis to understand the full extent of
  security incidents and take appropriate response actions to contain, remediate,
  and recover.
• § Incident Handling: Support cyber-security
  incident managers and decision makers with root cause analysis and formulating
  recommendations for detection and prevention controls.
• § Technical Project Work: Use your
  technical capabilities to enhance our existing processes as well as identifying
  and working on new methods to deliver DFIR services to the ever-changing
  technology requirements of the business.
• § Threat Hunting & Detection Engineering:
  Lead intelligence-based threat hunts to uncover anomalous behaviour in our
  estate that is representative of the security threats most relevant to Tesco, testing
  and raising potential detections to contribute to our internal detection
  engineering programme.

You will need

• § 4+
  years of relevant experience.
• § Experience
  with responding to security incidents in large scale corporate on-premises and public
  cloud environments (preferably Microsoft Azure).
• § Experience
  with forensic analysis of cyber-security incidents on Windows, MacOS, and Unix
  operating systems and in-depth understanding of those operating systems.
• § Ability
  to perform static and dynamic analysis of suspicious scripts, executables etc.
• § Experience
  with a broad range of security technologies such as EDR, SOAR, and SIEM.
• § Ability
  to think critically and lead technical investigations.
• § Ability
  to handle high pressure situations in a calm, productive, and professional
  manner.
• § Proficiency
  in at least one programming or scripting language.

Whats in it for you?

• Annual
  bonus scheme of up to 20% of base salary
• Holiday
  starting at 25 days plus a personal day (plus Bank holidays)
• Private
  medical insurance
• 26
  weeks maternity and adoption leave (12 months service required at
  the qualifying date) at full pay, followed by 13 weeks of
  Statutory Maternity Pay or Statutory Adoption Pay, we also offer 6 weeks
  fully paid paternity leave
• Free
  24/7 virtual GP service, Employee Assistance Programme (EAP) for you and
  your family, free access to a range of experts to support your mental
  wellbeing

The above information is a shortened summary, refer
to our policies for full details

About Us

Our vision at Tesco is to become every customer's favourite way to shop, whether they are at home or out on the move. Our core purpose is ‘Serving our customers, communities and planet a little better every day’. Serving means more than a transactional relationship with our customers. It means acting as a responsible and sustainable business for all stakeholders, for the communities we are part of and for the planet.
We are proud to have an inclusive culture at Tesco where everyone truly feels able to be themselves. At Tesco, we not only celebrate diversity, but recognise the value and opportunity it brings. We're committed to creating a workplace where differences are valued, and make sure that all colleagues are given the same opportunities. We’re proud to have been accredited Disability Confident Leader and we’re committed to providing a fully inclusive and accessible recruitment process. For further information on the accessibility support we can offer, please click here.
We’re a big business and we can offer a range of diverse full-time & part-time working patterns across our many business areas, which means that we can find something that works for you. We work in a more blended pattern - combining office and remote working. Our offices will continue to be where we connect, collaborate and innovate. If you are applying internally, please speak to the Hiring Manager about how this can work for you - Everyone is welcome at Tesco.