Cyber Response & Recovery Assistant Manager (Reactive DFIR)
We are seeking a Cyber Response & Recovery Assistant Manager specialising in Reactive Digital Forensics and Incident Response (DFIR). This role will support the delivery of high-quality technical investigations and coordinated response activities following cyber incidents, helping clients understand what happened, contain threats, recover securely and strengthen their resilience. You will work across a varied caseload, including malware outbreaks, ransomware, data breaches, insider activity, business email compromise and other suspected security events.
Key responsibilities will include leading or supporting end-to-end incident response engagements; collecting, preserving and analysing digital evidence from endpoints, servers, cloud environments, networks and mobile devices; developing investigative timelines; identifying attack vectors, persistence mechanisms and indicators of compromise; and preparing clear technical and executive-level reports. You will assist with scoping incidents, managing priorities, maintaining accurate case records and presenting findings to stakeholders. The role will also involve mentoring junior team members, reviewing investigative outputs, contributing to post-incident reviews and helping improve response playbooks, forensic procedures and recovery processes. Participation in an on-call or out-of-hours response rota may be required.
Applicants should have practical experience in digital forensics, incident response, cyber investigations or a closely related discipline, with a strong understanding of enterprise infrastructure, Windows and Linux systems, networking, identity services, cloud platforms and common attack techniques. Familiarity with forensic and response tooling, evidence handling, threat intelligence, malware analysis or scripting with Python or PowerShell would be advantageous. Relevant professional certifications, such as GCFA, GCIH, GNFA, GCFE, EnCE, CREST or equivalent, are desirable but not essential. You will need excellent analytical, written and verbal communication skills, sound judgement under pressure, strong attention to detail and the ability to explain complex technical issues to both technical and non-technical audiences. A professional, collaborative approach and willingness to support continuous learning are essential.
Cyber Response & Recovery Assistant Manager (Reactive DFIR)
Other similar jobs
Popular job searches
Your next job
starts here.
JOB SPECIALISMS
LATEST JOBS
TOP SEARCHES
LOCATIONS
- Security Engineer
- Security Analyst
- Security Architect
- IT Security Manager
- Security Consultant
- SOC Analyst
- Identity Access Management IAM
- Cyber Security Consultant
- Cloud Security
- Application Security
- Incident Response
- Penetration Tester
LATEST JOBS
- Security Engineer (Contractor)
- Vice President, Field CISO Com...
- Microsoft 365 & Security Infra...
- Senior ICT Security Designer
- Data Protection Expert
- Data Protection Officer: Schoo...
- Data Protection Officer
- IT CONSULTANT (IT Management,...
- Technology and Cyber Employee...
- Cyber Security Consultant
- Cyber Security Consultant (Pen...
- Platform and Services Engineer...