Overview
The Senior DFIR Consultant will lead cyber investigations, primarily focusing on ransomware and business email compromise incidents. Working in a hybrid environment within a global risk consultancy, this role involves guiding these investigations from initial contact through to final reporting, leveraging forensic analysis to ensure thorough understanding and communication of findings to clients. The position requires extensive experience in DFIR investigations and providing strategic responses to live incidents.
Responsibilities
- Lead ransomware and business email compromise investigations from initiation to final report.
- Conduct forensic analysis across hosts, memory, and logs to identify initial access and data exfiltration routes.
- Investigate Microsoft 365 compromises, assessing malicious mailbox rules and suspicious sign-ins.
- Transform technical findings into coherent reports and updates for clients.
- Collaborate with a specialized team of DFIR practitioners on client engagements.
- Provide updates to clients on live incidents, ensuring clarity and understanding of the situation.
Requirements
- Experience leading DFIR investigations in a consultancy or incident response environment.
- Hands-on experience with ransomware investigation, including Windows host and memory forensics.
- Familiarity with business email compromise investigations within Microsoft 365 and Entra ID.
- Proficient with forensic tools such as KAPE, Velociraptor, X-Ways, Axiom or Volatility.
- Ability to produce clear written reports and communicate effectively during client calls.
- SC clearance or eligibility to obtain SC clearance, requiring five years of UK residency.