Digital Forensics & Incident Response Specialist (DFIR)

The Role

This senior hands-on position involves leading high-priority cyber investigations across endpoints, networks, and cloud environments, identifying root causes and attack methods. The specialist partners closely with incident response, threat defence, and security operations teams, while also driving improvements to forensic tooling, automation, and readiness processes.

Skills & Experience

Candidates need five or more years in DFIR or cyber investigations, with expertise in malware analysis, memory forensics, threat hunting, and evidence collection. Familiarity with SIEM, EDR, IDS/IPS, and DLP platforms is required. Relevant certifications such as GCFA, GCFE, EnCE, CFCE, or MCFE are strongly valued.

Who It Suits

This role suits an experienced DFIR professional who thrives on technically complex investigations and is equally comfortable mentoring junior analysts and communicating findings to non-technical stakeholders. It is well suited to someone seeking long-term career progression within a large, strategically invested security function.