Lead – Digital Forensics & Incident Response (DFIR)

About the role

We are seeking a hands‑on Lead for Digital Forensics & Incident Response (DFIR) to drive complex cyber‑investigations and guide remediation efforts. The role demands deep technical expertise in forensic analysis across Windows, Linux and cloud environments, and the ability to lead end‑to‑end incident handling.

Key responsibilities

• Manage full lifecycle investigations of ransomware, malware, unauthorized access, insider threats and data breaches.
• Conduct Windows and Linux forensic examinations, including disk, memory and endpoint analysis.
• Perform forensic acquisition, evidence preservation and maintain chain of custody.
• Leverage SIEM, EDR/XDR platforms and advanced tools (EnCase, FTK, Velociraptor, Volatility, KAPE, Autopsy, Wireshark) for threat hunting.
• Reconstruct incident timelines, perform root‑cause analysis and produce detailed forensic reports.
• Execute cloud investigations across Microsoft 365, Azure, AWS and GCP.
• Utilise scripting and query languages such as PowerShell, Python, KQL, SPL and Bash to automate analysis.

Required profile

• 5+ years of professional experience in DFIR, incident response or cyber investigations.
• Strong hands‑on forensic background; not a pure SOC monitoring position.
• Relevant certifications preferred (GCFA, GCIH, GCIA, CHFI, EnCE, CFCE, CISSP, CISM, SC‑200 or equivalent).

Required skills

• Windows & Linux forensics
• Disk, memory & endpoint forensic analysis
• Forensic acquisition, evidence preservation, chain of custody
• SIEM, EDR/XDR investigation
• EnCase, FTK, Velociraptor, Volatility, KAPE, Autopsy, Wireshark
• Incident timeline reconstruction, root‑cause analysis, forensic reporting
• Cloud platforms: M365, Azure, AWS, GCP
• PowerShell, Python, KQL, SPL, Bash scripting