Staff Incident Response Analyst

The Role

This hands-on position serves as the senior technical escalation point for L2 SOC analysts and an external MDR partner, handling complex intrusions, cloud forensics, and high-stakes containment decisions. Day-to-day work involves threat hunting in the SIEM, extracting host artifacts via EDR, analysing cloud audit logs, and reconstructing attacker timelines from raw evidence.

Skills & Experience

Candidates must demonstrate deep practical expertise across SIEM platforms, EDR tooling, and cloud IAM investigation, with the ability to independently interpret forensic evidence without guidance. Experience handling multi-system intrusions and ambiguous attacker behaviour is essential, and relevant incident response or forensics certifications would strengthen an application.

Who It Suits

This role suits a seasoned incident responder who thrives under pressure and is comfortable operating as the final technical authority before management escalation. It is ideal for someone who prefers spending their working day deep in tooling rather than in meetings, and who consistently works faster and more thoroughly than junior analysts.