NMC Cyber Incident Responder (Digital Forensics)

The Role

Working within a National Management Centre Cyber Incident Response team, the role involves leading investigations into ransomware, malware, unauthorised access and insider threat incidents affecting UK policing. Day-to-day responsibilities include forensic acquisition and analysis of endpoints, servers and cloud environments, producing defensible findings for operational and legal audiences, and briefing Chief Officers and senior IT leaders throughout incident lifecycles.

Skills & Experience

Candidates should have hands-on experience in enterprise digital forensic investigations, endpoint and memory forensics, and log analysis using EDR telemetry and SIEM platforms. Strong knowledge of Windows internals, OS artefacts, attacker tradecraft and frameworks such as MITRE ATT&CK is expected. Experience with forensic best-practice evidence handling and incident response lifecycle methodologies is essential.

Who It Suits

This role suits an experienced DFIR professional comfortable operating at the intersection of technical forensics and senior stakeholder engagement. Those with a background in law enforcement or public-sector cyber security will find the national policing context particularly relevant, though strong private-sector practitioners with enterprise IR experience are equally well placed.