Incident Response Consultant – Microsoft Security (NA)

Quorum Cyber; United States; Hybrid; USD 120,000 - 180,000; Full time

Job summary

Quorum Cyber is seeking an experienced Incident Response professional in the United States to lead investigations, perform forensics, and coordinate with SOC, MDR and client teams. You will analyse Windows, Linux, macOS and cloud environments, identify attacker TTPs, and help shape response actions.

The role requires deep technical skills in security telemetry, Microsoft-aligned security stacks, and experience with AI-enabled incident workflows.

Qualifications

• Experience performing host, network, and memory forensics.
• Proficient in analysing logs, traffic, disks, and volatile artefacts.
• Familiar with Windows, Linux, macOS and multi-cloud environments.
• Strong understanding of enterprise security controls and attacker TTPs.
• Experience with AI-enabled IR workflows is a plus.

Responsibilities

• Support investigations into cyber security incidents across diverse technologies and environments.
• Perform forensics and evidence handling with proper chain-of-custody.
• Identify threat actor tools, tactics, and procedures (TTPs).
• Analyse logs, network traffic, and artefacts to determine attacker actions and impact.
• Interact with customers and stakeholders during incidents and provide guidance.
• Collaborate with SOC, MDR, Threat Intelligence and other teams.
• Contribute to improving detection, escalation, containment and recovery processes.

Skills

Forensic analysis

Memory forensics

Log & network analysis

EDR & SIEM usage

Microsoft security stack

Threat hunting

Scripting / automation

I/O and evidence handling

Communication

Tools

EDR

SIEM

Microsoft Defender

Azure/M365 security tools

Job description

Quorum Cyber is seeking an experienced Incident Response professional in the United States to lead investigations, perform forensics, and coordinate with SOC, MDR and client teams. You will analyse Windows, Linux, macOS and cloud environments, identify attacker TTPs, and help shape response actions.

The role requires deep technical skills in security telemetry, Microsoft-aligned security stacks, and experience with AI-enabled incident workflows.