Principal Security Consultant

Zensec is one of the UK's fastest-growing cyber security providers. As part of the award-winning Zenzero Group, recognised as a Top 8 Technology Company at the British Business Awards 2026, a Deloitte Best Managed Company, and featured in the Sunday Times Hundred in both 2025 and 2026, we're helping ambitious organisations strengthen their security posture in an increasingly complex digital world.

Our mission is simple: to make cyber security practical, proactive, and effective for mid-market businesses. From managed detection and response, security operations, and threat monitoring to governance, risk, compliance, and security consulting, we help organisations stay secure, resilient, and ready for what's next.

Demand for cyber security expertise has never been greater, and neither has our ambition. As a certified B Corp and Scale Up Award winner, we believe high growth and high standards go hand in hand. We're building a business where talented people can do meaningful work, make a real impact, and help shape the future of cyber security.

Fast growth. High standards. Real impact. If that sounds like your kind of place, we'd love to hear from you.

About the Role

As a Principal Security Consultant, you will lead high-impact digital forensics and incident response (DFIR) engagements for clients facing some of today's most challenging cyber threats, including ransomware, business email compromise (BEC), and ClickFix attacks. Acting as the senior technical lead throughout the incident lifecycle, you will guide investigations from initial triage through containment, forensic analysis, recovery, and final reporting.

Working within the DFIR Forensics team, you will collaborate with incident managers, SOC specialists, account teams, insurers, legal partners, and client leadership. This is an opportunity to shape investigation methodology, strengthen tooling, mentor consultants, and influence the development of a growing cyber security practice.

Success in this role means delivering exceptional client outcomes, providing trusted technical leadership during live incidents, developing team capability, and continuously improving forensic processes and services.

Job requirements

• Proven ability to lead complex DFIR investigations and manage client-facing incident response engagements.
• Deep understanding of ransomware intrusion lifecycles and adversary tradecraft.
• Strong expertise in Microsoft 365 and BEC investigations, including audit log analysis and identity compromise scenarios.
• Advanced knowledge of Windows host forensics, evidence collection, event log analysis, and memory analysis techniques.
• Experience presenting technical findings and recommendations to senior stakeholders.
• Strong communication, judgement, and decision-making skills under pressure.
• Degree-level education in a relevant discipline or equivalent practical experience.
• Experience supporting insurer-led or legally privileged investigations.
• Experience within an NCSC CIR Enhanced organisation.
• Knowledge of Google Workspace investigations.
• Industry certifications such as GCFA, GCFE, GCIH, GNFA, GREM, CREST CCIM, or CRIA.

Job responsibilities

• Lead end-to-end incident response engagements involving ransomware, BEC, and ClickFix attacks.
• Own forensic investigations across Windows environments, Active Directory, Microsoft 365, Azure, and endpoint platforms.
• Drive the production of executive-level and technical reports that clearly communicate root cause, attacker activity, and business impact.
• Advise clients on containment strategies, recovery planning, and security improvement actions during live incidents.
• Mentor and coach consultants and analysts, raising technical capability across the DFIR team.
• Build and enhance forensic tooling, playbooks, investigation timelines, and MITRE ATT&CK-aligned methodologies.
• Partner with pre-sales and business development teams to support scoping discussions and client proposals.
• Private health insurance
• Generous holiday allowance + a day off on your birthday
• Enhanced pension contributions
• Regular social events across all our offices

#J-18808-Ljbffr