> Markdown version of [/jobs/ext/340830-dfir-expert-lead-digital-forensics-and-incident-response-soc-specialist-ii-cyber-security](https://www.wearedevelopers.com/jobs/ext/340830-dfir-expert-lead-digital-forensics-and-incident-response-soc-specialist-ii-cyber-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# DFIR Expert (Lead) - Digital Forensics and Incident Response (SOC Specialist II - Cyber Security)

- **Company:** UST Global
- **Location:** Leeds, UK
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Cyber Security, Linux, Digital Forensics, Malware, Cybercrime
- **Published:** June 13, 2026
- **Apply:** https://uk.indeed.com/viewjob?jk=a8bdb5a3c587e56e

## About the Role

Do you have experience in Root cause analysis?, * Strong experience across DFIR, SOC, Threat Hunting, or InfoSec

 * Deep knowledge of Windows/Linux, networks, and attack techniques
 * Hands-on malware analysis (dynamic & static)
 * Proven ability to lead in high-pressure, real-time environments
 * Willingness to support critical incidents (24/7 escalation tier), digital forensics,incident response,threat hunting,infosec,malware analysis

## Description

Are you a cyber security professional who thrives on investigating complex breaches and leading from the front?

Join CyberProof as a DFIR Expert (Lead) and play a critical role in responding to high-impact cyber incidents. You'll lead forensic investigations, guide incident response efforts, and act as the highest escalation point, working directly with clients to contain threats and protect their environments.

What You'll Do

 * Lead end-to-end incident response (containment, eradication, recovery)
 * Conduct advanced digital forensics across endpoints, memory, and networks
 * Act as the technical lead during major incidents, managing stakeholders and clients
 * Enhance DFIR capabilities through tooling, automation, and process improvement
 * Deliver clear incident reports and Root Cause Analysis


## Related Videos

- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Enhancing Workload Security in Kubernetes](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes)
- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)