Senior DFIR Consultant

You’ll be the technical lead on critical cyber incidents for a global risk consultancy. You’ll run forensic investigations to an evidential standard for law firms, major multinationals and government clients. It’s a senior role with real influence on where the forensic and incident response capability goes next across EMEA.

• Location:
  
  remote, UK-based
• On-call for incidents that come up at short notice, with international travel up to 25% of the time
• Level: Senior Consultant, reporting to an Associate Director or Director of DFIR

• Act as technical lead on critical incidents, delivering quality-assured forensic incident management.
• Carry out forensic collections, investigations and analysis, keeping detailed contemporaneous notes so the work stands up to evidential scrutiny.
• Produce written analyses, reports and presentations for audiences with very different levels of technical knowledge.
• Work with cyber response, investigations and technical consulting teams across regions.
• Coach and develop other members of the team.
• Turn enquiries into proposals and support business development.

• Experience leading cyber incidents that needed a forensic response.
• Strong computer forensics skills, with evidence handling to recognised best practice such as NPCC, NIST or SANS.
• Deep knowledge of Windows and Linux, on-premises and in the cloud, including Microsoft 365, Azure and AWS.
• Scripting and data skills for log analysis, such as Power Shell, Bash, Python or SQL.
• Confidence handling clients in crisis situations, with clear written and spoken communication.
• Experience scoping work, including estimates, project plans and proposals.

• Experience with forensic tools such as EnCase, Nuix, Axiom or Black Bag.
• Certifications such as EnCE, GCFA or CISSP.
• An understanding of the EDRM.

• Remote working from anywhere in the UK.
• Direct responsibility and a say in the direction of the EMEA forensic and IR practice.
• Varied work across law firms, multinationals and government clients.
• Close links with eDiscovery, investigations and data analytics teams, broadening your exposure.