Cyber Incident Response Consultant

At UBDS, we help organisations transform through cloud, cyber security, AI and digital innovation. As our Managed Services capability continues to grow, we're looking for an experienced Cyber Incident Response Consultant to join our Security and Infrastructure Operations Centre (SIOC), based in either London or Manchester.

This is a hands-on, customer-facing consultancy role focused on investigating, responding to and recovering from cyber security incidents across complex customer environments. You will support and lead incident response engagements, conduct digital forensic investigations and advise customers on strengthening their cyber resilience and incident response capabilities.

You will work primarily across Microsoft and AWS environments, alongside SIEM, EDR and digital forensic tooling.

• Lead or support customer-facing cyber incident response engagements, from initial investigation through containment, eradication, recovery and reporting.
• Investigate security incidents including ransomware, malware, phishing, account compromise and unauthorised access.
• Conduct digital forensic investigations across endpoints, servers, cloud environments and network infrastructure.
• Analyse security logs, endpoint telemetry, forensic artefacts and indicators of compromise to establish incident scope and root cause.
• Use EDR, SIEM and forensic tooling to investigate suspicious activity and reconstruct attack timelines.
• Advise customers on containment decisions, remediation priorities and recovery approaches.
• Support eradication and recovery activities, validating remediation and identifying any remaining security risks.
• Collect, preserve and document digital evidence, following appropriate forensic procedures and chain-of-custody requirements.
• Produce professional incident investigation reports, including findings, timelines, root cause and remediation recommendations.
• Present investigation findings and recommendations to technical teams, customers and senior stakeholders.
• Support threat hunting, detection engineering and improvements to security monitoring capabilities.
• Develop and improve incident response playbooks, processes and procedures.
• Design and support cyber incident exercises, including tabletop scenarios, simulated incidents and response workshops.
• Facilitate or contribute to exercises, evaluating response effectiveness and producing post-exercise recommendations.
• Work closely with SIOC analysts, security engineers, cloud specialists and wider Managed Services colleagues during incidents.
• Provide technical guidance and mentoring to less experienced security professionals.

We're looking for someone with strong incident response experience, practical forensic investigation skills and the confidence to engage directly with customers.

• Experience working within Cyber Incident Response, DFIR, SOC/SIOC or a similar cyber security environment.
• Hands-on experience investigating and responding to cyber security incidents.
• Experience supporting or leading customer-facing incident response engagements.
• Strong experience with EDR tooling, SIEM platforms and security log analysis.
• Understanding of incident response processes, including containment, eradication, recovery and lessons learned.
• Practical knowledge of digital forensic techniques, including endpoint, memory, network or cloud forensics.
• Experience collecting and preserving digital evidence, with an understanding of chain-of-custody principles.
• Ability to analyse attacker activity, indicators of compromise and common attack techniques.
• Good understanding of Windows, Linux, networking and cloud security.
• Experience investigating security incidents within Microsoft and/or AWS environments.
• Experience producing technical…