Incident Response Consultant

Location: Remote / Edinburgh, UK
job type: Permanent / Full-time
Sector and subsector: IT | Cybersecurity
Salary: Negotiable salary

At Quorum Cyber, we're on a mission to help good people win.

Founded in Edinburgh in 2016, we're one of the fastest growing cyber security companies in the UK and North America, serving over 400 customers on four continents. We protect organisations against the rising threat of cyber-attacks, enabling them to thrive in an increasingly unpredictable and inhospitable digital landscape.

As a Microsoft-only security house, a Microsoft Solutions Partner for Security, a member of the Microsoft Intelligent Security Association (MISA), and winner of the Microsoft Security MSSP of the Year 2025 award, we offer a unified security ecosystem comprised of innovative services, all delivered through our customer platform, Clarity.

In September 2024, Quorum Cyber acquired Canada-based, Microsoft Solutions Partner for Security, Difenda. This was closely followed in December 2024 by the acquisition of US-based, Kivu Consulting, a global cyber security firm with world-leading incident response capabilities.

Incident Response is a core and strategic component of Quorum Cyber’s business. It is central to supporting our managed security services and MDR customers, providing specialist expertise when incidents require investigation, containment, remediation, and recovery beyond routine monitoring and response.

The Incident Response Consultant supports investigations into cyber security incidents and, with appropriate guidance, takes ownership of defined investigative work streams. The role provides sound technical analysis, contributes to customer guidance, and works closely with the SOC, MDR, Threat Intelligence, and wider cyber security teams to ensure that incidents are managed effectively.

As an award-winning Microsoft Solutions Partner for Security, Quorum Cyber follows a Microsoft-first mission across its security services. The role develops practical expertise in Microsoft security technologies and telemetry while contributing to the evolution of Incident Response alongside Quorum Cyber’s MDR and SOC capabilities.

Agentic AI will increasingly support the collection, correlation, enrichment, prioritisation, and investigation of security data. The role will participate in the testing, validation, and safe adoption of AI-enabled Incident Response and MDR workflows, applying sound judgement, following defined processes, and escalating uncertainty or consequential decisions appropriately.

• Support investigations into cyber security incidents across diverse technologies and environments, taking ownership of defined investigative work streams and seeking guidance when required.
• Perform host, network, and memory forensics, including Windows, Linux, macOS, and multi-cloud artefact analysis.
• Identify threat actor tools, tactics, and procedures (TTPs).
• Analyse logs, network traffic, disk images, and volatile artefacts to determine attacker intent, actions, timelines, and impact.
• Ensure evidence collection and handling follow best practice, including documentation and chain-of-custody standards.
• Maintain awareness of emerging threats, malware families, and evolving threat actor behaviours.
• Interact with customer stakeholders, legal teams, technical staff, and executive leadership during incidents.
• Use lessons learned from incidents to improve internal and customer detection, escalation, containment, response, and recovery processes.
• Work closely with the SOC, MDR, Threat Intelligence, and other specialist teams to coordinate investigations, improve escalation pathways, and enrich intelligence outputs.
• Apply working knowledge of Microsoft security technologies and telemetry to…