Corporate Forensic Analyst

Overview

Corporate Forensic Analyst —

Location:

Remote/Hybrid (UK-based).

The role is to join the CYFOR Secure Incident Response team and focus on corporate forensic investigations across computers, mobile devices, cloud platforms and email environments. The focus is on forensic investigation and evidential analysis within cyber security incidents, supporting clients through structured and defensible digital forensic examinations. You will work with the wider Incident Response team on investigations into business email compromise (BEC), ransomware and other cyber incidents where forensic analysis is required.

While not primarily an incident response position, there are opportunities to assist live investigations and support broader response activities where appropriate. The ideal candidate will have experience with forensic examinations across Windows systems, mobile devices and cloud-based environments, with strong reporting skills, client-facing professionalism, integrity and discretion in sensitive investigations. In return, you will receive a salary commensurate with experience, plus training, overtime and excellent career prospects.

This is a unique opportunity to join a highly successful business that values its team members.

• Conduct forensic examinations of desktop computers, laptops, servers and mobile devices using forensically sound methodologies.
• Acquire, preserve and analyse digital evidence from Windows systems, mobile devices, cloud platforms and email environments while maintaining evidential integrity.
• Perform dead-box forensic investigations involving deleted data recovery, user activity analysis, timeline reconstruction and artefact examination.
• Investigate cloud and email platforms including Microsoft 365, Exchange Online and associated audit logs to identify suspicious or malicious activity.
• Support investigations into ransomware, business email compromise (BEC), insider threats, data theft and unauthorised access incidents.
• Use forensic and case management tooling including Magnet Axiom and Salesforce throughout investigations and evidence handling workflows.
• Produce high-quality forensic reports suitable for internal stakeholders, legal teams, law enforcement and corporate clients.
• Assist with expert witness statements and provide court attendance when required.
• Support the Incident Response team during active cyber incidents where forensic expertise is required.
• Maintain accurate chain of custody documentation and evidence handling procedures throughout investigations.
• Deliver clear and concise updates to clients and stakeholders throughout engagements.
• Assist with forensic triage and evidence collection during onsite and remote engagements when required.
• Contribute to the continuous improvement of forensic methodologies, processes and internal capabilities.
• Keep up to date with emerging threats, forensic techniques and evolving technologies across endpoint, mobile and cloud ecosystems.
• Support knowledge sharing and mentoring activities across the wider team where appropriate.

• Minimum 3 years’ experience in digital forensics or cyber investigations.
• Experience conducting dead-box forensic investigations across Windows systems and mobile devices.
• Experience collecting, preserving and analysing digital evidence using industry-standard forensic methodologies.
• Experience using Magnet Axiom, Encase or X-Ways and other digital forensic tooling.
• Knowledge of Microsoft 365, Exchange Online and cloud-based investigations.
• Ability to analyse forensic artefacts and reconstruct user and system activity timelines.
• Understanding of ransomware and business email compromise investigations.
• Experience producing detailed technical and client-facing forensic reports.
• Excellent written and verbal communication skills.
• Strong attention to detail and investigative mindset.
• Ability to handle sensitive and confidential investigations professionally.
• Excellent client-facing skills with the ability to communicate effectively at all levels.
• Ability to work independently and manage multiple investigations simultaneously.
• Demonstrate a flexible approach to work and a high level of…