Senior Incident Response Lead - Threat Hunting & Forensics

Bonhill Partners Ltd; Greater London; On-site; GBP 120,000 - 180,000; Full time

Job summary

Bonhill Partners Ltd in London is seeking a Senior Incident Response Analyst (VP) to lead investigations across global banking operations. You will own incidents from triage to containment, eradication, recovery and post-incident review, coordinating with SOC, Threat Intelligence, and Infrastructure teams.

This hands-on role requires 8+ years in security operations, expert knowledge of MITRE ATT&CK, NIST/SANS methods, and experience with Splunk, Microsoft Sentinel and QRadar.

Qualifications

• 8+ years in Security Operations with at least 3 years in Incident Response.
• Hands-on experience with security investigations and triage.
• Familiarity with SIEM platforms and threat analysis methodologies.
• Experience with MITRE ATT&CK and regulatory considerations.

Responsibilities

• Lead and support the investigation of cybersecurity incidents of varying severity.
• Conduct incident triage, containment, eradication and recovery.
• Investigate alerts to determine scope, impact and remediation needs.
• Perform threat and forensic analysis using SIEM and telemetry.
• Develop incident timelines and maintain investigation documentation.
• Apply MITRE ATT&CK to identify malicious activity and escalate when needed.
• Collaborate with SOC, Threat Intelligence and Infra teams on investigations.
• Participate in post-incident reviews and lessons-learned sessions.
• Contribute to playbooks, workflows, and escalation procedures.

Skills

Incident response

Threat analysis

Security investigations

Communication skills

NIST/SANS

Tools

Splunk

Microsoft Sentinel

QRadar

EDR

CrowdStrike Query Language

Job description

Bonhill Partners Ltd in London is seeking a Senior Incident Response Analyst (VP) to lead investigations across global banking operations. You will own incidents from triage to containment, eradication, recovery and post-incident review, coordinating with SOC, Threat Intelligence, and Infrastructure teams.

This hands-on role requires 8+ years in security operations, expert knowledge of MITRE ATT&CK, NIST/SANS methods, and experience with Splunk, Microsoft Sentinel and QRadar.