DFIR Analyst

Digital Forensics | Cyber Investigations | Incident Response

Are you passionate about uncovering digital evidence, investigating cyber incidents, and helping organisations understand what really happened during a security event?

We're looking for a Digital Forensics Investigator to support complex cyber investigations, incident response activities, and evidence-led enquiries. This role offers the opportunity to work across endpoints, cloud environments, mobile devices, and enterprise security platforms, applying forensic techniques to identify, preserve, analyse, and present digital evidence.

You’ll work closely with internal investigation teams, security stakeholders, legal professionals, and law enforcement to ensure investigations are thorough, accurate, and conducted in accordance with appropriate evidence-handling procedures.

• Conduct digital forensic investigations, collecting and analysing electronic evidence to support internal investigations, legal proceedings, and cybersecurity incident response.
• Identify, acquire, preserve, and analyse digital evidence across laptops, servers, mobile devices, cloud platforms, and enterprise environments.
• Investigate suspicious activity, unauthorised access, compromised accounts, data breaches, and other potential security incidents through forensic artefacts and log analysis.
• Analyse Microsoft 365 and other cloud-based environments to identify relevant activity, establish timelines, and support attribution of user or threat actor actions.
• Use digital forensic and eDiscovery tools to investigate incidents, refine large datasets, and develop effective evidence-collection strategies.
• Support incident response activities by analysing logs, endpoint telemetry, network traffic, malware, and other digital artefacts.
• Maintain the integrity, confidentiality, and admissibility of evidence through accurate documentation and strict chain-of-custody procedures.
• Prepare clear, factual forensic reports documenting investigative processes, findings, analysis, and conclusions.
• Collaborate with internal security, compliance, ethics, and investigations teams, as well as external legal advisers, law enforcement, and technology vendors.
• Contribute to the continuous improvement of forensic procedures, investigation methodologies, and evidence-handling protocols.
• Keep up to date with emerging cyber threats, forensic techniques, industry standards, and developments in digital investigation practices.

• An undergraduate qualification in IT, computer science, digital forensics, or a related discipline - or equivalent relevant experience.
• Professional certifications in information security, digital forensics, or incident response are advantageous.
• A postgraduate qualification in computer science, digital forensics, or a related field would be beneficial.

• Strong understanding of the digital forensic lifecycle: identification, preservation, collection, examination, analysis, documentation, and presentation of evidence.
• Knowledge of the ACPO Good Practice Guide for Digital Evidence and its application to forensic investigations.
• Practical experience using digital forensic and eDiscovery tools such as Magnet AXIOM, Cellebrite, FTK, EnCase, Nuix, Relativity, or Paladin
  .
• Strong working knowledge of Microsoft 365, cloud platforms, and log analysis
  , including the ability to investigate suspicious or unauthorised account activity.
• Experience working with Endpoint Detection and Response (EDR) technologies and analysing endpoint telemetry.
• Understanding of SIEM platforms, security monitoring, IDS/IPS, firewalls, and network traffic analysis.
• Experience collecting and analysing evidence from Windows, Linux, and macOS systems, as well as mobile devices, servers, and cloud environments.
• Knowledge of incident response methodologies, cyberattack techniques, threat actors, malware behaviour, and digital artefact analysis.
• Understanding of networking fundamentals, including TCP/IP, routing, subnetting, network architecture, and common network protocols.
• Familiarity with cloud security, encryption, data loss prevention (DLP), and relevant cybersecurity standards and regulations.

• Strong analytical thinking and the ability to connect evidence from multiple systems to establish an accurate sequence of events.
• Excellent attention to detail and a methodical, evidence-led approach to…