Principal Consultant, DFIR

The Role

This position involves leading end-to-end incident response engagements, from initial identification and containment through to recovery and reporting. Practitioners conduct digital forensic investigations across servers and endpoints, perform log analysis, and when required, manage threat actor communications and ransomware negotiations as part of live incident support.

Skills & Experience

Candidates require deep technical expertise in digital forensics and incident response, including endpoint and server forensics and log analysis. Strong analytical, written, and communication skills are essential. Experience handling ransomware or extortion scenarios and the ability to operate effectively under pressure in high-stakes environments are also expected.

Who It Suits

This role suits a seasoned DFIR practitioner comfortable working independently against engagement milestones and making sound judgements in fast-moving situations. Those with experience spanning both technical investigation and sensitive stakeholder communications, and who thrive in a consultancy environment handling complex, high-impact incidents, will find this role a strong fit.