DFIR Lead Cyber Operations Analyst

The Role

This VP-level position sits at the heart of a major bank’s cyber defence function, leading digital forensics and incident response investigations. Day to day, analysts examine malware, malicious samples and network traffic, collaborate with internal teams, external partners and law enforcement, and produce detailed, high-quality reports for senior stakeholders. An on-call rotation is required.

Skills & Experience

Candidates must demonstrate strong DFIR expertise spanning host, network, cloud and live forensic analysis, alongside excellent written and verbal communication skills. Cloud investigation experience across AWS, Azure or Google Cloud is advantageous, as are scripting skills in Python, PowerShell or Bash. Certifications such as GCFA, GNFA, GCFE or GREM are highly valued.

Who It Suits

This role suits an experienced cyber or digital forensics professional who thrives under pressure and enjoys technically complex, hands-on investigation work. Someone comfortable leading cross-functional stakeholders, communicating findings to non-technical audiences and operating within a regulated financial environment will find this position particularly well matched to their background.