Senior Incident Response Consultant; North America)

At Quorum Cyber, we're on a mission to help good people win. Founded in Edinburgh in 2016, we're one of the fastest growing cyber security companies in the UK and North America, serving over 400 customers on four continents. We protect organisations against the rising threat of cyber-attacks, enabling them to thrive in an increasingly unpredictable and inhospitable digital landscape.

As a Microsoft-only security house, a Microsoft Solutions Partner for Security, a member of the Microsoft Intelligent Security Association (MISA), and winner of the Microsoft Security MSSP of the Year 2025 award, we offer a unified security ecosystem comprised of innovative services, all delivered through our customer platform, Clarity.

In September 2024, Quorum Cyber acquired Canada-based, Microsoft Solutions Partner for Security, Difenda. This was closely followed in December 2024 by the acquisition of US-based, Kivu Consulting, a global cyber security firm with world‑leading incident response capabilities.

Incident Response is a core and strategic component of Quorum Cyber's business. It is central to supporting our managed security services and MDR customers, providing specialist expertise when incidents require investigation, containment, remediation, and recovery beyond routine monitoring and response.

The Senior Incident Response Consultant leads and conducts complex cyber security investigations, providing expert technical analysis, guidance, and strategic advice to customers. This role combines advanced digital forensics, threat analysis, and incident response leadership with consulting, mentoring, and readiness activities that strengthen customer resilience and support Quorum Cyber's mission to protect organisations from harm.

The role works closely with the SOC, MDR, Threat Intelligence, and wider cyber security teams to ensure that incidents are managed effectively and that lessons learned are used to strengthen detection, response, readiness, and overall customer resilience. The role also contributes to the continued development of Quorum Cyber's Incident Response capability through consulting, guiding, service improvement, and customer readiness activities.

As an award‑winning Microsoft Solutions Partner for Security, Quorum Cyber follows a Microsoft‑first mission across its security services. The Senior Incident Response Consultant will apply expert knowledge of Microsoft security technologies and telemetry while helping Incident Response evolve alongside Quorum Cyber's MDR and SOC capabilities.

Agentic AI will increasingly support the collection, correlation, enrichment, prioritisation, and investigation of security data. The role will contribute to the design, testing, validation, and safe adoption of AI‑enabled Incident Response and MDR workflows, applying expert judgement to validate AI‑generated findings, identify uncertainty, and ensure that investigative and response activity remains evidence‑based, auditable, proportionate, and accountable.

• Lead complex incident investigations across diverse technologies, environments, and customer situations, including working outside core hours when required.
• Perform advanced host, network, and memory forensics, including Windows, Linux, macOS, and multi‑cloud artefact analysis.
• Identify threat actor tools, tactics, and procedures (TTPs).
• Analyse logs, network traffic, disk images, and volatile artefacts to determine attacker intent, actions, timelines, and impact.
• Ensure evidence collection and handling follow best practice, including documentation and chain‑of‑custody standards.
• Maintain deep situational awareness of emerging threats, malware families, and evolving threat actor behaviours.
• Interact…