Principal Cyber Incident Response Consultant

The Role

This principal-level position leads end-to-end incident response engagements, conducting advanced forensic analysis across host, network, and memory environments in Windows, Linux, macOS and multi-cloud platforms. The consultant manages evidence collection to defensible standards, briefs executive stakeholders during live incidents, delivers readiness assessments, and facilitates tabletop exercises for customers across EMEA and North America.

Skills & Experience

Candidates should bring deep expertise in memory and disk forensics, log and network traffic analysis, EDR and SIEM platforms, and Active Directory/identity systems. Proficiency with Microsoft security stacks is valued, alongside the ability to map adversary behaviour to TTPs, handle chain-of-custody evidence, and build scripts or playbooks to streamline investigations. NCSC-aligned working practices are relevant.

Who It Suits

This role suits a seasoned DFIR professional ready to operate at principal level — equally comfortable leading technical investigations and presenting to board audiences. Those who enjoy mentoring junior analysts, shaping IR processes, and working in a remote-first, people-focused MSSP environment will find it particularly rewarding.