Incident Response Analyst Outside ir35
City Of London, Central London, Greater London, England, UK
Listed on 2026-10-29
-
IT/Tech
Cybersecurity, Information Security & Data Protection, Security Management & Operations
Incident Response Analyst– Contract– Outside ir35
Rate– GBP
450 per day, outside IR35
Location– 2 days onsite (London), 3 days' work from home
Duration– 12–month contract.
Incident Response Analyst
Practical experience in cyber incident response, security monitoring or a Security Operations Centre environment.
Hands–on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies.
Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
Working knowledge of incident response life cycle activities, including preparation, detection, analysis, containment, eradication, recovery and lessons learned.
Experience producing incident records, investigation reports, management updates and post–incident findings.
Understanding of attacker behaviours and frameworks, including MITRE ATT&CK, Cyber Kill Chain and NIST incident response guidance.
Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint security, vulnerability management and data loss prevention.
Ability to manage multiple priorities, exercise sound judgement under pressure and communicate clearly with technical and senior stakeholders.
Awareness of evidence handling, forensic integrity, confidentiality and regulatory considerations relevant to cyber investigations.
Experience with threat intelligence, malware analysis, Scripting or automation using Power Shell, Python, KQL or similar languages.
Relevant professional experience supported by a degree in cyber security, computer science or a related discipline, or equivalent practical experience.
One or more relevant certifications such as GCIH, GCIA, GCFA, GNFA, SC–200, CySA+, CISSP or equivalent are desirable.
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).