FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in leading complex Digital Forensics and Incident Response (DFIR) investigations, with a strong focus on ransomware, Microsoft 365, and Windows forensics. Capable of producing detailed reports and advising clients on incident containment and recovery strategies while mentoring team members to enhance technical capabilities.
Highest-signal resume keywords
Digital Forensics And Incident Response (DFIR)Microsoft 365 InvestigationsWindows Host ForensicsRansomware Intrusion LifecyclesIndustry Certifications (GCFA, GCFE, GCIH)
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Forensic InvestigationAudit Log AnalysisEvent Log AnalysisMemory Analysis TechniquesIncident Response EngagementsContainment StrategiesRecovery PlanningTechnical Report ProductionMITRE ATT&CK MethodologiesEvidence Collection
Soft Skills
Strong CommunicationJudgement Under PressureDecision-Making SkillsMentoringCoaching
Tools & Technologies
Active DirectoryAzureEndpoint PlatformsGoogle WorkspaceClickFix
Certifications & Qualifications
GCFAGCFEGCIHGNFAGREMCREST CCIMCRIA
Industry Keywords
BEC InvestigationsInsurer-Led InvestigationsLegally Privileged InvestigationsNCSC CIR Enhanced OrganisationAdversary Tradecraft
Tech Stack
Tools & technologiesAzure
About the role
Key responsibilities & impact- Lead end-to-end incident response engagements involving ransomware, BEC, and ClickFix attacks
- Own forensic investigations across Windows environments, Active Directory, Microsoft 365, Azure, and endpoint platforms
- Drive the production of executive-level and technical reports communicating root cause, attacker activity, and business impact
- Advise clients on containment strategies, recovery planning, and security improvement actions during live incidents
- Mentor and coach consultants and analysts, raising technical capability across the DFIR team
- Build and enhance forensic tooling, playbooks, investigation timelines, and MITRE ATT&CK-aligned methodologies
- Partner with pre-sales and business development teams to support scoping discussions and client proposals
Requirements
What you’ll need- Proven ability to lead complex DFIR investigations and manage client-facing incident response engagements
- Deep understanding of ransomware intrusion lifecycles and adversary tradecraft
- Strong expertise in Microsoft 365 and BEC investigations, including audit log analysis and identity compromise scenarios
- Advanced knowledge of Windows host forensics, evidence collection, event log analysis, and memory analysis techniques
- Experience presenting technical findings and recommendations to senior stakeholders
- Strong communication, judgement, and decision-making skills under pressure
- Degree-level education in a relevant discipline or equivalent practical experience
- Experience supporting insurer-led or legally privileged investigations
- Experience within an NCSC CIR Enhanced organisation
- Knowledge of Google Workspace investigations
- Industry certifications such as GCFA, GCFE, GCIH, GNFA, GREM, CREST CCIM, or CRIA
Benefits
Comp & perks- Private health insurance
- Generous holiday allowance + a day off on your birthday
- Flexible working patterns
- Enhanced pension contributions
- Regular social events across all our offices