Digital Forensics & Incident Response Analyst

The Role

The analyst conducts digital forensic investigations across Windows, Linux, cloud, and operational technology environments, supporting the full incident response lifecycle from triage through to post-incident review. Day-to-day work includes threat hunting, behavioural analysis, forensic root cause analysis, and contributing to detection engineering and security uplift projects.

Skills & Experience

Candidates need proven enterprise-scale DFIR experience, strong knowledge of forensic artefacts — including registry, event logs, persistence mechanisms and fileless attacks — and hands-on use of tools such as X-Ways, EnCase, Autopsy, Timesketch and Plaso. Experience with SIEM platforms and cloud or memory forensics is advantageous.

Who It Suits

This role suits an experienced DFIR practitioner who is comfortable operating independently on complex investigations, can communicate findings clearly to technical and non-technical stakeholders, and is motivated to mentor junior team members while continuously improving security capabilities within a large, globally distributed organisation.