Job Search

We are seeking a Senior DFIR Investigator to lead complex digital forensics and incident response engagements across a range of cyber security incidents. You will be responsible for investigating suspected compromises, data breaches, insider threats, malware infections and other security events, providing clear, evidence-based findings to technical and non-technical stakeholders. The role requires sound judgement, strong investigative discipline and the ability to manage multiple priorities in a fast-paced environment.

Your responsibilities will include directing end-to-end investigations, from initial triage and evidence preservation through to forensic acquisition, analysis, reporting and lessons learned. You will examine endpoint, server, cloud, network, email and mobile artefacts; identify attack vectors and indicators of compromise; develop timelines; and assess the scope and impact of incidents. You will also support containment and remediation activities, contribute to incident response playbooks, maintain accurate case documentation and present findings to senior leadership, clients or legal representatives where required. The role may involve participating in an out-of-hours on-call rota and assisting with complex investigations across multiple jurisdictions.

Applicants should have substantial experience in digital forensics and incident response, with a strong understanding of investigative methodologies, chain of custody and evidence handling. Experience using industry-standard forensic, e-discovery, endpoint detection and response, SIEM and threat intelligence tools is expected, alongside practical knowledge of Windows, Linux, cloud environments, networking and common attack techniques. Relevant professional certifications, such as GCFA, GCIH, EnCE, CHFI or equivalent, are desirable. You should be able to communicate complex technical issues clearly, produce high-quality written reports and provide effective guidance to less experienced investigators. A methodical approach, professional integrity, curiosity and the ability to remain composed during high-severity incidents are essential.