Senior Incident Response & Digital Forensics Lead

Bloomberg; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

Bloomberg’s Cyber Security Operations Center (CSOC) is seeking a Senior Incident Response & Digital Forensics Analyst to lead investigations of the most complex security incidents. You will analyze host, memory, network, and log evidence, acquire forensic images, examine binaries, and reconstruct attacker activity to determine what happened and the impact.

You will work with Engineering, Legal, and Compliance, mentor the wider THIR team, and help shape forensic capabilities by developing

Qualifications

• Lead security incident investigations end to end from signal through root-cause analysis and written conclusion.
• Disk and memory forensics across Windows, Linux, and macOS, including evidence acquisition and analysis.
• Malware analysis experience, including static/dynamic analysis and extraction of observables for detection.
• Strong knowledge of OS internals across Windows, Linux, and macOS.
• Networking fundamentals, including TCP/IP, DNS, routing, and traffic analysis.
• Experience with Splunk or comparable enterprise log-analysis platforms.

Responsibilities

• Lead technical investigations of complex security incidents and escalations from start to finish.
• Acquire and examine forensic images; analyze host, memory, and network evidence; investigate suspicious binaries.
• Establish ground truth quickly during significant incidents and maintain technical ownership of the investigation.
• Mentor teammates through pairing, playbooks, and knowledge sharing to raise team capabilities.

Skills

Incident response leadership

Digital forensics

Threat hunting

Malware analysis

Memory forensics

Disk forensics

OS internals

Networking fundamentals

Splunk

Python scripting

Tools

Splunk

Volatility

CrowdStrike RTR

Osquery

Sysmon

Carbon Black

Tanium

Jira

Jupyter notebooks

Git

Job description

Bloomberg’s Cyber Security Operations Center (CSOC) is seeking a Senior Incident Response & Digital Forensics Analyst to lead investigations of the most complex security incidents. You will analyze host, memory, network, and log evidence, acquire forensic images, examine binaries, and reconstruct attacker activity to determine what happened and the impact.

You will work with Engineering, Legal, and Compliance, mentor the wider THIR team, and help shape forensic capabilities by developing