Senior Windows IR Practitioner | Cyber Security Training

TryHackMe; Greater London; À distance; GBP 85 000 - 120 000; Plein temps

Avantages offerts par ce poste

Remote work

Training budget

Company retreat

Health insurance

Lunch covered

401k / Pension

Laptop + accessories

Flexible hours

Résumé du poste

TryHackMe is seeking experienced incident responders and blue team practitioners to join our Content Engineering team. You will transform real-world IR expertise into world-class training content with hands-on labs and datasets.

This role offers flexible contract options and the potential for permanent hire, building engaging cybersecurity training for a growing community. You will design realistic, scenario-driven labs, develop companion training materials, and collaborate closely with

Qualifications

• Real-world IR experience in Windows environments.
• Strong grounding in Windows forensics and artifact analysis.
• Knowledge of offensive techniques in Windows/AD and how to detect them.

Responsabilités

• Research, design, and develop defensive cyber security training material with hands-on labs.
• Create realistic labs reflecting how attacks unfold in enterprise Windows environments.
• Develop and configure virtual machines and datasets for cybersecurity labs.
• Collaborate with your team to share expertise and raise quality.
• Plan and design portions of the content development roadmap.

Connaissances

Incident Response

Threat Hunting

Digital Forensics

L3 SOC Analyst

Outils

EZ Toolset

Velociraptor

KAPE

Description du poste

TryHackMe is the fastest-growing online cyber security training platform. Our mission is to make learning and teaching cyber security easier by providing gamified security exercises and challenges. Having only been around for handful of years, we've grown to more than 7+ million community members and our growth isn't slowing down!

The Role

We're looking for experienced incident responders and blue team practitioners to join our Content Engineering team. Your job is simple in concept: take what you know from real world IR work and turn it into world class training content. You'll take your years of real world experience and teach your peers and the next generation.

We're open to permanent hires as well as short-term and longer-term contract options.

Job Responsibilities

• Research, design, and develop defensive cyber security training material with supporting hands-on lab exercises (such as virtual machines and datasets for analysis).
• Draw on your real world IR experience to build realistic, scenario driven labs that reflect how attacks actually unfold in enterprise Windows environments.
• Develop and configure virtual machines and sample datasets for realistic cybersecurity labs.
• Collaborate closely with your team by sharing expertise, reviewing each other's work, and raising the quality bar collectively.
• Take charge of planning and designing portions of the content development roadmap.
• Collaborate with the Head of Content Engineering to continuously improve the content development process.
• Analyse industry trends in tooling and techniques and recreate them as teachable content.
• Strategically plan, review, and schedule content with our blue team content engineering team

Technical Skills & Experience

To be considered for this opportunity, you must have significant hands on relevant cyber security industry experience in roles such as Incident Responder, Threat Hunter, Digital Forensics Investigator or L3 SOC Analyst.

You Should Also Demonstrate

• Proven, hands-on experience responding to real incidents in Windows environments. Triaging compromised endpoints, analysing forensic artefacts, and reconstructing attacker timelines from initial access through to impact.
• Solid grounding in Windows forensics and artefact analysis - event logs, registry hives, NTFS artefacts, and memory/disk forensics - with the ability to extract attacker activity from both live systems and forensic images.
• Working knowledge of offensive techniques used against Windows and Active Directory environments, including credential dumping, privilege escalation, Kerberos-based attacks, and lateral movement, and critically, how to detect them in forensic artefacts, contain them during live response, and prevent recurrence.
• Hands-on familiarity with attacker tooling and tradecraft - fileless execution, living-off-the-land techniques (LOLBins), common exfiltration methods, and ransomware deployment patterns - including the TTPs of active APT groups and ransomware-as-a-service operators.
• Experience with DFIR collection tooling such as EZ Toolset, Velociraptor, KAPE, or equivalent with an understanding of how to conduct IR at scale across enterprise environments.
• Strong verbal and written English communication skills, essential for conveying complex technical concepts.

Preferred Skills (nice-to-have):

• Any experience creating training content, writing documentation, or explaining technical concepts to others either formally or informally
• Deeper expertise in one or more specialist areas: Active Directory attack paths (Kerberoasting, DCSync, ADCS), memory forensics (MemProcFS, Volatility), or advanced NTFS analysis
• Creating challenges for capture the flags (CTFs)
• Experience leading, coaching, or mentoring others
• Certifications such as GIAC Certified Incident Handler (GCIH), GIAC Certified Enterprise Defender (GCED), Security Analyst Level 2 (SAL2), Certified Forensic Analyst (GCFA)

Benefits & Perks:

• 100% Remote - In a fully digital world, work from anywhere you want!
• Flexi Time - Choose your own hours as long as you have at least 4 hours of overlap with the UK timezone (from 8am - 6pm)
• Tools - a dedicated work laptop + any accessories you need to do your best work.
• Swag Pack - start your TryHackMe journey with a branded swag bundle!
• Personal Development - £2,500 training budget to acquire certifications, and more.
• Company Retreat - an annual company retreat, fully paid for by us!
• Lunch on us - whether you're a pizza-lover, salad obsessed or a big sushi fan, TryHackMe will cover the cost of your lunch order during our recurring company virtual lunches.
• Health Insurance - if you're in a country that doesn't have public health care.
• Enhanced Maternity & Paternity- an enhanced package on top of statutory requirements.
• 401k / Pension - TryHackMe makes it easy to save money for your retirement.

Our Hiring Process

• Stage 1: Short introduction call (30 mins)
• Stage 2: Technical Take Home Exercise (part 1 & 2)
• Stage 3: Interview with our Head of Content Engineering (one hour)
• Stage 4: Final call with a Co-Founder (30 mins)

At this time, we are unable to provide sponsorship.