Digital Forensics Jobs: United Kingdom

Digital Forensic Investigator

Cleveland Police

Teesside, England

As a Digital Forensic Investigator, you will examine and analyse digital devices and data to support police investigations. The role involves recovering and interpreting digital evidence, producing clear reports, maintaining accurate records, and working with investigators to ensure evidence is handled securely and in line with legal and forensic standards.

Lead Cyber Incident Response Consultant

The Tech Recruiter

United Kingdom

Remote · Lead/Principal · Full-time · £80,000.00/yr - £100,000.00/yr

Lead complex cyber incident investigations across Windows, Linux, macOS and multi-cloud environments. Perform advanced digital forensics, threat analysis, and evidence handling while advising clients and mentoring junior team members on IR readiness.

Cyber Response & Recovery Manager (Reactive DFIR) – German Speaking

KPMG UK

London, England

Hybrid · Manager · Full-time

Lead reactive DFIR engagements as case manager on medium to large incidents, conducting digital forensics and incident response, developing client IR capabilities, and managing cyber response tooling and playbooks for a Tier 1 UK provider.

Incident Responder

Rooted

London, England

Mid · Full-time

Scope and contain live security incidents, reconstruct intrusions using host and network forensics, preserve evidence, and produce clear written timelines for clients and regulators in a fast-paced IR consultancy environment.

Frontline Digital Forensic Technician (FTC/Secondment)

Thames Valley Police

Milton Keynes, England

Onsite · Junior · Full-time

Fixed-term/secondment role within a police Forensic Investigation Unit, conducting frontline triage and early examination of digital exhibits, identifying material for further analysis, and supporting crime investigations across multiple locations.

Cyber Security Incident Response Analyst

IBM

Hursley, England

Onsite · Mid · Full-time

Join IBM's CSIRT team conducting forensic investigations and cyber incident analysis, including digital media examination, network traffic analysis, malware triage, SIEM log review, and evidence handling across heterogeneous environments.

Cyber Incident Responder

CYFOR

Manchester, England

Hybrid · Mid · Full-time · £40,000 - £50,000 a year

Experienced Cyber Incident Responder needed to investigate and contain cyber incidents, conduct forensic acquisitions, analyse malware, correlate evidence from compromised systems, and deliver technical reports to clients. SC clearance required.

Senior DFIR Investigator

Solis

London, England

Onsite · Senior · Permanent, Full-time

Lead complex cyber incident investigations across host, network and cloud environments, analysing threat actor activity, producing forensic reports, mentoring junior investigators and delivering proactive cyber resilience services for global clients.

Director, Digital Forensics & Incident Response (Global)

NCC Group

Manchester, England

Onsite · Lead/Principal · Full-time

Lead a global Digital Forensics and Incident Response function, setting strategic direction, overseeing major cyber incidents, developing advanced forensic capabilities, and driving operational excellence across regionally distributed teams.

Senior Digital Forensics and Incident Response (DFIR) Consultant

Cypfer

London, England

Hybrid · Senior · Full-time

Lead complex DFIR investigations for a global cybersecurity first-responder firm, conducting forensic analysis across Windows/Linux/virtual platforms, malware triage, threat hunting, and incident response for ransomware and cyber-extortion events.

Cyber Response & Recovery Manager – German Speaker

KPMG

London, England

Hybrid · Manager · Permanent, Full-time

Manages reactive DFIR engagements as case lead, conducting digital forensics across disk, memory, network and logs, advising clients on threat landscape, building IR capabilities, and developing internal tooling and runbooks.

Senior Digital Forensics and Incident Response Analyst

Barclays

Knutsford, England

Onsite · Senior · Permanent

Senior DFIR Analyst role within a financial institution's Security Operations Centre, leading investigation of complex cyber incidents, applying digital forensic techniques, analysing endpoint and network artefacts, and improving detection and response capabilities.

Digital Forensics and Incident Response (DFIR) Consultant

Cypfer

London, England

Hybrid · Mid · Full-time

Consultant role covering end-to-end incident response and digital forensics, including forensic acquisition, Windows triage, malware analysis, IOC investigation, log review, and client-facing remediation for ransomware and cyber-extortion cases.

Digital Forensics Practitioner

HM Revenue and Customs

Nottingham, England

Onsite · Mid · Permanent, Part-time, Full-time · £31,096 - £37,919 a year

Support HMRC fraud investigations by conducting forensic acquisition and examination of digital devices including computers, mobile phones and CCTV systems within a world-class law enforcement forensic laboratory in Nottingham or Stratford.

Digital Forensics Laboratory Team Leader

CCL Solutions Group Ltd

Stratford-upon-Avon, England

Onsite · Lead/Principal · Permanent, Full-time

Lead and manage a digital forensics laboratory team, overseeing analyst performance, caseload management, quality standards, training, and customer project delivery, while maintaining a personal forensic examination caseload.

Senior Incident Response Security Consultant, Mandiant, Google Cloud

Google

Remote

Remote · Senior

Lead complex incident response engagements for Mandiant clients, conducting host and network forensics, malware triage, threat hunting, and cloud investigations while mentoring junior consultants and communicating findings to executive stakeholders.

Digital Forensic Unit Investigator

Northumbria Police

Newcastle Upon Tyne, England

Onsite · Mid · Full-time · £30,276.00/yr - £41,028.00/yr

Join Northumbria Police's Digital Forensics Unit, extracting and analysing data from 2,000+ devices annually. Duties include evidence retrieval, specialist advice to investigators, victim identification, court testimony, and continuous quality improvement.

Digital Forensics and Incident Response Analyst

Mishcon de Reya LLP

London, England

Hybrid · Mid · Full-time

Join an NCSC/CREST-accredited cyber team as a first responder handling client cyber incidents, conducting forensic acquisition and analysis across platforms including mobile devices, and supporting containment, eradication and remediation activities.

Digital Media Examiner – Counter Terrorism Policing

West Midlands Police

Birmingham, England

Onsite · Mid · Full-time

Specialist digital forensics examiner role within a Counter Terrorism Policing Digital Media Exploitation Unit, conducting forensic acquisition and analysis of digital devices, preparing evidence packages, attending court, and maintaining ISO 17025 accreditation.

Digital Media Examiner – Technician – NDES S3 – Police Staff – CTP London

Counter Terrorism Policing

Brompton, England

Onsite · Mid · Full-time

Join Counter Terrorism Command as a Digital Forensic Technician, conducting forensic imaging and data extraction from mobile devices, computers and storage media. Support investigations, peer-review examinations and provide court witness testimony.

Digital Forensics and Cyber Crime Investigator – South West Regional Organised Crime Unit (SWROCU)

Avon and Somerset Police

Almondsbury, England

Onsite · Mid · Full-time

Join a Regional Cyber Lab conducting live and dead-box data recovery, network forensics, and mobile device examination to support serious cybercrime investigations including ransomware, intrusions, malware and data breaches across the South West region.

Incident Response Lead, DFIR

Seldon Lab

London, England

Hybrid · Lead/Principal · Full-time

Founding Incident Response Lead role at an AI-native DFIR company, leading complex cloud and enterprise investigations, codifying best practices, and collaborating with AI engineers to automate routine forensics tasks.

Digital Forensics Laboratory Team Leader

CCL Solutions Group

Stratford-Upon-Avon, England

Onsite · Lead/Principal · Full-time

Lead and manage a digital forensics laboratory team, overseeing analyst performance, caseload assignment, quality standards compliance (ISO17025, FSR), training, and customer-facing project delivery, while maintaining a personal forensic caseload.

Principal Consultant, Incident Response (Weekend Schedule)

Alto

London, England

Remote · Lead/Principal · Internship

Lead client-facing incident response engagements including forensic investigations, host-based analysis, log review and data breach investigations on a Friday–Monday schedule. SC clearance eligibility required. Up to 20% travel expected.

Digital Multimedia Evidence Unit Manager

Nottinghamshire Police

Nottingham, England

Onsite · Manager · Temporary

Lead Nottinghamshire Police's Digital Multimedia Evidence Unit, overseeing forensic preservation, extraction and presentation of CCTV, audio and video evidence, ensuring ISO compliance, managing team performance and attending court as an expert witness.

Senior Incident Response Security Consultant, Mandiant, Google Cloud

Google

United Kingdom

Remote · Senior · Full-time

Lead complex, high-profile incident response engagements for enterprise clients, conducting host and network forensics, malware triage, threat hunting, and log analysis while developing reports for technical and executive audiences.

Cyber Response & Recovery Assistant Manager (Reactive DFIR)

KPMG UK

London, England

Hybrid · Mid · Full-time

Hands-on reactive DFIR assistant manager role within a Tier 1 UK incident response team, performing digital forensics across disk, memory, network and logs, managing smaller cases and supporting clients through complex cyber incidents including ransomware and network intrusions.

Senior DFIR Analyst

hackajob

Knutsford, England

Onsite · Senior · Full-time

Senior DFIR Analyst role within a major bank's Security Operations Centre, leading investigation of complex cyber incidents, applying digital forensic techniques, analysing endpoint and network artefacts, and driving remediation across hybrid enterprise environments.

Principal Consultant, Incident Response (Weekend Schedule)

Palo Alto Networks

London, England

Remote · Lead/Principal · Full-time

Lead and manage end-to-end incident response engagements for a range of clients, conducting host-based forensic analysis, log review, and breach investigations using industry-standard tools to deliver containment and remediation guidance.

Senior DFIR Investigator

CFC

London, England

Onsite · Senior · Full-time

Lead complex digital forensics and incident response investigations across host, network and cloud environments. Analyse threat actor activity, produce forensic reports, mentor junior investigators, and deliver proactive cyber resilience services to global clients.

Principal Consultant, Incident Response (Unit 42)

Palo Alto Networks

City Of London, England

Remote · Lead/Principal · Full-time

Lead client-facing incident response engagements for Unit 42, performing host-based forensic analysis, log investigation, and data breach response across Windows, Linux, and macOS. Mentor junior staff and deliver actionable remediation recommendations to clients.

Data Forensic Investigator

Wiltshire Police

Devizes, England

Onsite · Mid · Full-time · £47,010.00/yr - £49,608.00/yr

Responsible for identifying, preserving, extracting and presenting digital evidence from computers and mobile devices in support of criminal investigations. Provides expert advice to officers and presents findings at judicial proceedings.

Digital Forensics Practitioner

HM Revenue & Customs

Nottingham, England

Onsite · Mid · Part-time

Support HMRC fraud investigations by forensically acquiring and examining digital devices including computers, mobile phones and CCTV systems. Prepare evidential reports, attend court, assist with warrant executions, and adhere to ISO17025 and FSR standards.

Cyber Incident Response

LT Harper Recruitment Group

England

Hybrid · Mid · Full-time · £55,000.00/yr - £85,000.00/yr

Three cyber response consulting roles covering digital forensics and incident response, security operations advisory, and post-incident recovery and remediation. Requires SC/DV clearance and experience with complex incidents across government and critical infrastructure.

Cyber Security Analyst

The Tech Recruiter

United Kingdom

Remote · Lead/Principal · Full-time · £85,000.00/yr - £95,000.00/yr

Lead complex cyber incident investigations across Windows, Linux, macOS and multi-cloud environments. Perform advanced digital forensics, threat analysis and evidence handling while advising clients at executive level and mentoring junior team members.

Digital Forensics Specialist

TechNET IT Recruitment Ltd

Cheltenham, England

Hybrid · Mid · Full-time

Join a global organisation's Cyber Incident Response Team, conducting forensic investigations across endpoints, cloud and identity platforms during live incidents, producing technical reports and improving forensic tooling and playbooks.

Data Forensic Technician

Avon and Somerset Police

Bristol, England

Onsite · Junior · Full-time

Join a South West Police forensics team examining computers and digital devices to extract and analyse evidence for criminal cases. Responsibilities include forensic imaging, triage examination, evidential statements, and court presentation.

Cyber Response and Recovery – Assistant Manager (Reactive)

KPMG

London, England

Hybrid · Mid · Permanent, Full-time

Hands-on reactive DFIR role within a Tier 1 UK incident response team. Perform digital forensics, manage smaller IR cases, advise on threat landscape, support client IR capability building, and contribute to internal tooling and lab development.

Digital Forensic Unit Technician

Northumbria Police

Newcastle Upon Tyne, England

Onsite · Junior · Full-time · £28,689.00/yr - £29,859.00/yr

Join a police Digital Forensic Unit extracting and analysing data from 2,000+ devices annually. Responsibilities include forensic data recovery, equipment maintenance, quality compliance, expert reporting, and court attendance to support criminal investigations.

Digital Forensics Investigator – Birmingham City Centre

Resillion

Birmingham, England

Onsite · Mid · Full-time · £30,000.00/yr - £35,000.00/yr

Experienced Digital Forensic Investigator required to conduct forensic examinations of mobile devices, computers and digital storage media, producing court-ready reports and presenting evidence as an expert witness within an ISO/IEC 17025 accredited environment.

Forensics Consultant

Lineal

London, England

Hybrid · Mid · Full-time

Client-facing digital forensics consultant responsible for forensic data collection, processing and analysis across PCs, mobile devices, servers and cloud systems. Leads investigations end-to-end, advises on best practices and supports eDiscovery processes using tools such as EnCase, FTK and Cellebrite.

Cyber Response & Recovery – Senior Manager

KPMG UK

United Kingdom

Hybrid · Manager · Other

Senior manager role leading cyber incident response and digital forensics engagements, managing a team of practitioners, developing IR capabilities, tools and runbooks, and advising clients on threat landscape and response maturity.

Digital Forensic Consultant – £50,000 to £75,000 – London (flexible hybrid)

APT Search

London, England

Hybrid · Senior · Full-time · £50,000.00/yr - £75,000.00/yr

Lead end-to-end digital forensic investigations for a global risk and investigations consultancy. Responsibilities include onsite/remote collections, analysis across mobile and desktop platforms, forensic reporting, and client-facing presentation of findings.

Data Forensic Investigator – ICAT

Avon and Somerset Police

Bristol, England

Onsite · Mid · Full-time

Join a police digital forensics unit examining computers and mobile devices to gather evidence for criminal cases. Responsibilities include forensic analysis, suspect interviews, court testimony, search warrant support, and hi-tech crime investigation.

Digital Forensics & Cyber Incident Responder – Hybrid – London

Lorien

London, England

Hybrid · Mid · Full-time

Join a specialist DFIR team investigating live cyber attacks, ransomware incidents and security breaches. Responsibilities include forensic evidence analysis, threat hunting, malware analysis and supporting clients through complex security incidents.

Assistant Digital Investigator

Resillion

Birmingham, England

Onsite · Junior · Full-time

Perform forensic examination and data acquisition of digital devices including mobile phones and computers, recover extant and deleted data, produce intelligence reports, and provide expert witness testimony in Crown Court to national forensic standards.

Digital Forensics Examiner – NDES S3 – Police Staff – CTP London

Counter Terrorism Policing

Brompton, England

Onsite · Mid · Full-time

Counter Terrorism Policing seeks a Digital Forensics Examiner to forensically image and analyse digital devices, recover encrypted/deleted data, prepare evidential reports and statements, and support major CT investigations including on-call and scene attendance duties.

DFIR Investigator

CFC

London, England

Onsite · Senior · Full-time

Lead complex digital forensics and incident response investigations across host, network and cloud environments for global clients. Analyse threat actor activity, produce forensic reports, mentor junior investigators, and deliver proactive cyber resilience services.

Senior Digital Forensic Analyst

In Technology Group

Stratford-Upon-Avon, England

Onsite · Senior · Full-time

Senior analyst role within an accredited UK forensics lab, conducting mobile and computer examinations, producing court-admissible reports for criminal and civil proceedings, peer reviewing junior analysts, and managing an independent caseload to ISO 17025 and FSR standards.

Information Security Incident Response Analyst

NTT DATA

London, England

Hybrid · Mid · Full-time

Join a global DFIR team investigating security incidents through host, disk, memory, network and cloud forensic analysis. Reconstruct attacker timelines, support containment and remediation, and deliver clear findings across diverse client environments. UK SC required.

Digital Forensics Practitioner

Derbyshire Constabulary

Derby, England

Onsite · Mid · Full-time

Conduct advanced digital forensic investigations for a UK police constabulary, extracting evidence from mobile phones and hard drives, producing court-ready reports and statements, and advising officers on digital evidence seizure and handling.

Digital Forensics Investigator – Team Leader

Resillion

Birmingham, England

Onsite · Lead/Principal · Full-time

Lead a team of digital forensics investigators in Birmingham, conducting forensic examination of computer and mobile devices, producing expert reports and court statements, mentoring staff, and maintaining ISO 17025 quality standards. SC clearance required.

Incident Response Security Consultant, Mandiant

Google

London, England

Hybrid · Mid · Full-time

Join Mandiant's elite IR team conducting end-to-end incident response investigations, host and network forensics, malware triage, and log analysis. Lead client-facing engagements, manage containment and remediation, and develop technical and executive-level reports.

Incident Response & Digital Forensics Consultant – London | Hybrid Working | On-Call Allowance

Lorien

London, England

Hybrid · Mid · Full-time

Join a specialist cyber consulting team conducting digital forensic investigations and incident response engagements. Analyse logs, network traffic and endpoints, support clients during live incidents, and produce technical reports on findings.

INCIDENT RESPONSE LEAD, DFIR (UK)

Asymmetric Security

London, England

Lead/Principal · Full-time

Lead complex DFIR investigations including BEC, ransomware and network intrusions in cloud environments. Build defensible timelines, develop AI-assisted tooling, and codify best practices as a founding technical team member.

Corporate Forensic Analyst

CYFOR

Remote

Remote · Mid

Experienced forensic analyst needed to conduct dead-box investigations across Windows, mobile and cloud environments, analyse digital artefacts, produce defensible reports, and support incident response activities including BEC and ransomware cases.

Cyber Digital Forensics & Incident Response Manager

Capgemini

Inverness, Scotland

Hybrid · Manager · Full-time

Lead a team of DFIR analysts within a 24x7 cyber defence centre, overseeing incident response, digital forensic investigations, evidence analysis, playbook development, and executive reporting for clients across endpoint and cloud environments.

Cyber Incident Response & Digital Forensics Assistant Manager

KPMG UK

London, England

Hybrid · Mid · Full-time

Hands-on DFIR consultant role within a tier 1 UK cyber response team, performing incident response and digital forensics across disk, memory, network and log data, while advising clients on the evolving threat landscape.

Digital Forensics Senior Associate

JPMorganChase

London, England

Senior · Full-time

Senior digital forensics role supporting internal investigations and cybersecurity incidents. Responsibilities include evidence collection, forensic analysis, malware examination, root cause assessments, and cross-functional collaboration with Legal, HR and Technology teams.

Digital Forensics Apprentice

West Midlands Police

Birmingham, England

Onsite · Junior · Full-time

An apprentice role within a police digital forensics unit, learning evidence preservation, data extraction, device examination and court presentation under supervision, while completing an accredited qualification in digital forensics practice.

Senior Digital Investigator – Mobile

Resillion

Birmingham, England

Onsite · Senior · Full-time

Senior mobile forensics investigator role based in Birmingham, conducting device examinations, producing court-ready reports and expert witness statements, mentoring junior staff, and managing complex casework to evidential standards.

Senior DFIR / Incident Response / Digital Forensics

hackajob

Knutsford, England

Onsite · Lead/Principal · Full-time

VP-level DFIR Lead Cyber Operations Analyst role delivering advanced digital forensics and incident response within a major bank's cyber defence function, covering malware analysis, host/network/cloud forensics, and cross-functional stakeholder management.

Cyber Incident Response Manager

KPMG UK

London, England

Hybrid · Manager · Full-time

Hands-on Cyber Response & Recovery Manager role within a Tier 1 UK incident response team. Leads complex cyber incidents, performs digital forensics, develops client IR capabilities, runbooks, and internal tooling and platforms.

Cyber Response & Recovery – Senior Manager

KPMG

London, England

Hybrid · Senior · Permanent, Part-time, Full-time

Senior Manager role leading cyber incident response and digital forensics engagements for clients. Responsibilities include hands-on forensic analysis, IR capability development, team leadership, runbook authoring, and client-facing advisory work across complex cyber incidents.

Cyber Incident Response Manager

Pwc UK

London, England

Hybrid · Manager · Full-time

Lead and manage cyber incident response engagements for global clients, performing technical analysis of breaches and intrusions, mentoring junior staff, developing detection content, and collaborating with threat intelligence and ethical hacking teams.

Cyber Security Consultant

Realtime Recruitment

Northern Ireland

Onsite · Mid · Full-time · £35,000.00/yr - £40,000.00/yr

Mid-level Cyber Incident Response Consultant role involving detecting, investigating and responding to cybersecurity incidents, conducting forensic analysis, managing containment and recovery, and producing technical reports for clients across enterprise environments.

Cyber Digital Forensics & Incident Response Manager

Capgemini

Manchester, England

Hybrid · Manager · Full-time

Lead a team of DFIR analysts within a 24x7 Cyber Defence Centre, overseeing incident response, digital forensic investigations, evidence analysis across endpoint and cloud environments, and executive-level reporting.

Senior Digital Forensic Operations Officer

National Crime Agency (NCA)

Tamworth, England

Onsite · Senior · Full-time

Lead scene-based digital forensic practitioners and deliver forensic services supporting serious and organised crime investigations. Provide tactical and strategic advice on evidence identification, capture and preservation across electronic devices nationally.

Forensic Computer Analyst

Police Scotland

Edinburgh, Scotland

Onsite · Mid · Full-time · £51,637.00/yr - £57,707.00/yr

Join Police Scotland's Cyber and Fraud Unit as a Forensic Computer Analyst, conducting forensic examination of digital devices, preparing court reports, attending crime scenes, and supporting criminal investigations across Scotland.

Digital Forensics & Insider Risk Analyst

Morgan Stanley

Glasgow, Scotland

Onsite · Lead/Principal · Full-time

Lead end-to-end digital forensic investigations and eDiscovery activities within an insider risk management function. Responsibilities include evidence collection and analysis, SIEM correlation, stakeholder management, and ensuring regulatory defensibility across global financial services operations.

Digital Forensic Analyst

South Yorkshire Police

Sheffield, England

Onsite · Mid · Full-time

Join a police Digital Forensic Unit securing and analysing evidence from mobile phones and computers, presenting findings to courts, maintaining ISO17025 accreditation, and mentoring junior staff in a permanent Sheffield-based role.

International Digital Forensics and Incident Response (DFIR) Expert

Mastek

Reading, England

Hybrid · Senior · Full-time

Specialist DFIR role delivering end-to-end incident response and forensic examinations across endpoints, servers and cloud platforms for global clients, producing investigation reports and improving cyber resilience for public and enterprise sectors.

Senior Digital Forensic Analyst

Oscar

Stratford-Upon-Avon, England

Onsite · Senior · Full-time · £37,500.00/yr - £45,000.00/yr

Senior analyst role within an established UK forensics laboratory, conducting mobile and computer forensic examinations, producing court-admissible reports for criminal and civil proceedings, peer reviewing junior analysts, and contributing to ISO 17025 quality management.

DFIR Lead Cyber Operations Analyst

Barclays

Knutsford, England

Onsite · Lead/Principal · Full-time

VP-level hands-on DFIR role within a major bank, leading complex digital forensic investigations and incident response across host, network and cloud environments, with malware analysis, stakeholder reporting and on-call responsibilities.

Criminal Defence Digital Forensic Investigator

CYFOR

Manchester

Onsite · Mid · £31,000 - £60,000 a year

Examines digital evidence from computers, mobile devices and cloud platforms for criminal defence cases. Prepares expert witness reports, reviews prosecution evidence, and presents findings in court, working to ISO 17025 and FSR standards.

Senior Director | Digital Forensics & Investigations

FTI Consulting

London, England

Hybrid · Lead/Principal · Full-time

Lead complex digital forensic investigations across devices, cloud and mobile platforms for corporate, legal and regulatory clients. Act as expert witness, mentor junior staff, and drive methodology development within a global DFIR practice.

Information Security Incident Response Analyst

NTT DATA, Inc.

London, England

Mid · Full-time

Supports clients during security incidents through host, disk, memory, network, and cloud forensic analysis. Reconstructs attacker timelines, identifies IOCs, and delivers clear technical findings across diverse environments including OT/ICS systems.