Digital Forensics & Incident Response (DFIR) Lead

The Role

This position centres on detecting, investigating, and responding to cybersecurity incidents across enterprise environments. Day to day, practitioners perform forensic evidence collection, malware analysis, threat hunting, attack reconstruction, and incident containment, working across Windows, Linux, cloud platforms, and network infrastructure to protect and strengthen organisational security posture.

Skills & Experience

Candidates require 8–12 or more years in DFIR or incident response. Key technical areas include SIEM, EDR, NDR, XDR, cloud forensics, memory analysis, ransomware response, and IOC validation. Experience with phishing and Business Email Compromise investigations, forensic evidence handling, chain of custody procedures, and DFIR automation is essential to this senior-level position.

Who It Suits

This role suits a seasoned forensics and incident response professional who is comfortable leading complex investigations across hybrid environments and thrives under pressure. Someone with a methodical, evidence-driven approach who enjoys both hands-on technical work and contributing to broader enterprise incident response strategy will find this role well matched to their experience.