Digital Forensics Specialist

The Role

This position sits within a Cyber Incident Response Team, supporting active cyber incidents through hands-on forensic analysis across Windows, Linux and macOS endpoints, cloud platforms and identity services. Day-to-day work includes determining root cause, analysing attacker behaviour, producing technical reports and contributing to forensic playbook development and automation.

Skills & Experience

Candidates should bring strong expertise in endpoint, memory, disk and cloud forensics, including Microsoft 365 and Azure environments. Experience analysing forensic artefacts such as registry hives, event logs and persistence mechanisms is essential. Scripting ability in PowerShell, Python or Bash is expected, alongside familiarity with incident response lifecycles and evidence-handling procedures.

Who It Suits

This role suits an experienced DFIR professional who thrives under pressure during live incidents rather than purely post-incident investigations. Someone who combines deep forensic knowledge with a practical, collaborative mindset will excel here, particularly those comfortable working alongside Detection Engineering and Security Operations teams in a fast-paced enterprise environment.