Senior DFIR Investigator
HybridLondon, England, United Kingdom
Job Summary
Lead forensic investigations across host, network, and cloud environments to identify root causes, scope, and impact of cyber incidents. Analyze threat actor activity, malware, and potential data exposure while deploying incident response tooling to collect and preserve evidence. Produce high-quality forensic reports, attack timelines, and actionable recommendations for clients, providing trusted technical guidance throughout the response lifecycle. Lead smaller investigation teams, mentor junior investigators, and deliver proactive services including tabletop exercises and client-facing training. Collaborate with internal teams, legal, and external stakeholders to shape outcomes during critical moments. Maintain expertise across emerging threats and industry best practices.
Required Qualifications
- Significant experience in digital forensics and incident response within enterprise environments
- Expertise across host, network and application forensics
- Experience investigating complex cyber incidents from initial response through to reporting and remediation
- Strong understanding of threat actor tactics, techniques and procedures (TTPs)
- Hands-on experience with forensic and incident response tooling
- Familiarity with malware investigation and compromised system analysis
- Knowledge of enterprise infrastructure, including networks, endpoints and cloud environments
- Experience producing client-facing reports and presenting findings to both technical and non-technical audiences
- Strong stakeholder management and communication skills
- Experience mentoring, coaching or leading other investigators
Desired Qualifications
- Knowledge of industry frameworks and standards, including NIST and ISO, alongside an understanding of legal and regulatory considerations associated with cyber incidents
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.