Digital Forensics and Incident Response Analyst

The Department

The Cyber Risk and Complex Investigations team is made up of cyber and investigations specialists who work alongside our legal teams to provide a comprehensive and responsive client service.

Our practice works with clients to support them in the prevention of cyber-crime and the management of sophisticated and often complex cyber-attacks and helping them find digital information that supports their needs.

We have extensive experience of working on cyber security issues with a range of organisations, from large and complex global entities to mid-sized or small firms, start-ups and private individuals. We help our clients implement the cyber security they need to address their threats, ensuring compliance with regulatory standards. If an incident occurs, we use our expertise and experience to help clients manage the technological, legal and reputational risks.

Offering a wider breadth of service and a broader range of solutions than traditional investigators, our team combines cutting edge cyber intelligence skills with innovative investigative techniques, understanding the legal requirement to gather facts and evidence properly, safely and ethically. We assess every investigation to ensure it meets our ethical and quality standards, as well as using a robust review process.

The team provides NCSC and CREST accredited security incident response and digital forensics services both internally and to our external clients and we are looking to grow and develop our response team.

In this role you will be a key member of our incident response team , acting as a first responder when clients report cyber incidents to us. You will investigate, contain, and eradicate threats as part of our NCSC Cyber Incident Response (CIR) and NCSC Cyber Incident Exercising (CIE) accredited service lines . You will also work alongside our internal security team to assess and respond to internal incidents and security queue items.

You must be comfortable receiving and triaging r eported incidents, assessing risks quickly and accurately , escalating where necessary , and keeping clients informed throughout . You will operate under the pressure of live incident response conditions, making sound decisions and calmly developing and executing response plans to deliver concrete outcomes. Strong record-keeping and clear client communication are essential throughout .

Our incident response and digital forensics team operates a forensics lab to support the delivery of forensic services. You will be trained in digital forensics acquisition and investigation, with a particular focus on mobile device forensics. You will also be called upon regularly to support our internal security team and to provide technical advice and guidance to other internal teams to help them deliver the best possible advice to clients.

• Respond to client-reported cyber incidents as part of our NCSC CIR Standard Level accredited incident response service, conducting technical investigation activities under the direction of the incident lead.
• Assess risks related to system generated alerts and user reported issues , escalating promptly and in line with established playbooks .
• Action or elevate issues promptly and consistently in line with playbooks.
• Identify areas of improvement for process or technology and contribute to their implementation.
• Conduct forensic acquisition and analysis across a range of platforms and media in both incident response and discrete investigation scenarios , including specialist acquisition and examination of mobile devices .
• Assist with incident management, including scoping work, guiding clients through decision making, and supporting containment and eradication.
• Develop intelligence assessments of incidents and other potential threats to clients.
• Support clients with longer term guidance and support with remediation and security uplift activities.
• Provide specialist advice and guidance to internal teams on technical and forensic matters.
• Support the internal security team in assessing and responding to internal incidents , managing the security queue, and contributing to the continuous improvement of internal security posture .
• Contribute to Projects with both time and expertise.
• Provide a high standard of customer experience to our clients.

• Hands-on experience investigating security incidents, whether as a SOC analyst reviewing and analysing alerts and events, or as part of an incident response team…