Senior Consultant, DFIR, Reactive Services

About the role

Reactive investigation workstreams sit with this person, from evidence collection to client updates, alongside principal consultants and directors on each engagement.

At a glance

What you will do

• Run digital forensics and incident response investigations into ransomware, unauthorized access and similar incidents
• Own assigned workstreams and raise findings or blockers to the engagement lead
• Examine endpoint, host, network, identity and cloud evidence to build timelines and scope the compromise
• Acquire and analyse systems, memory, logs and endpoint telemetry
• Recommend containment, remediation and recovery steps backed by evidence
• Write technical reports and client updates, following chain-of-custody procedures

What they look for

• Hands-on enterprise DFIR experience
• Comfortable with forensic tools, evidence acquisition and log analysis
• Windows investigation experience; some familiarity with Linux, macOS or cloud
• Strong technical judgment and clear client communication
• Relevant degree or equivalent practical experience

Nice to have

• Consulting or incident response services background
• Malware triage, scripting and MITRE ATT&CK knowledge
• GCFA, GCFE, GCIH or similar certification
• Willing to travel up to 20%