> Markdown version of [/jobs/ext/3645003-senior-incident-responder](https://www.wearedevelopers.com/jobs/ext/3645003-senior-incident-responder). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Incident Responder

- **Company:** Bridewell
- **Location:** London, UK
- **Experience:** Expert
- **Salary:** £52,898.0
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Amazon Web Services, Microsoft Azure, Cyber Security, Digital Forensics, Network Architecture, Cloud Platform System, Mitre Att&ck, Malware, National Institute of Standards and Technology Cybersecurity Framework, Cybercrime, Blue Team (Cyber Security)
- **Published:** October 9, 2026
- **Apply:** https://www.adzuna.co.uk/jobs/details/5919287104

## About the Role

* Practical experience of incident response, security operations, digital forensics, or a closely related cyber security role.
 * Practical knowledge of digital forensic principles, including evidence preservation, forensic acquisition, chain of custody, artefact analysis, and clear documentation of findings.
 * Experience using digital forensic tools to examine endpoint or mobile device data is desirable, familiarity with logical mobile extraction using tools such as Magnet AXIOM would be beneficial.
 * Working knowledge of enterprise endpoint technologies, network infrastructure, and at least one major cloud platform such as AWS, Azure, or GCP.
 * Relevant training or certifications, such as Security Blue Team Level 1 or 2, GCIH, GCFA, or equivalent incident response and digital forensics qualifications, are desirable.
 * Experience working in a SOC, CSIRT, MSSP, consultancy, or internal security team is desirable.
 * An understanding of incident response within regulated or CNI environments would be beneficial.
 * Awareness of common security frameworks and standards, such as NIST CSF, ISO 27001, and the NIS Regulations.
 * Ability to communicate technical findings clearly to both technical and non-technical audiences through written reports and verbal updates.
 * Familiarity with SOC processes, security monitoring, and incident response procedures across hybrid IT environments.
 * Some experience of threat hunting methodologies and tools across enterprise environments.
 * A good understanding of common attack techniques, adversary behaviours, and TTPs, including familiarity with frameworks such as MITRE ATT&CK.

This position requires travel both UK and international to client locations, approximately 20-25% of working time, with expenses. The role will require on-call responsibilities as part of the incident response rotation

## Description

* Support the delivery and ongoing improvement of incident response services, including maintaining technical documentation, playbooks, and response procedures for endpoint, network, and cloud environments.
 * Follow established triage, investigation, and escalation processes when responding to alerts and security incidents across modern hybrid IT environments.
 * Investigate security incidents across endpoint, network, and cloud platforms, working with senior responders to identify appropriate containment, remediation, and recovery actions.
 * Carry out investigation, containment, and eradication activities for security incidents, escalating complex or high-priority matters when required.
 * Support the forensic acquisition, preservation, examination, and analysis of digital evidence from endpoints and other relevant systems, maintaining appropriate evidential handling and investigation records.
 * Undertake logical acquisition and forensic analysis of supported mobile devices, including Android, iOS, iPadOS, and Windows devices, using approved tooling and documented processes. Device access may require a valid passcode.
 * Work collaboratively with other incident responders and SOC analysts to ensure consistent, high-quality delivery across client environments.
 * Support customers in improving their detection and response capabilities across their IT estate.
 * Contribute to the development and maintenance of incident response plans and playbooks in line with industry standards and good practice.
 * Support and conduct threat hunts across endpoint, network, and cloud environments.
 * Perform initial malware analysis and support more detailed analysis where required during incident response activities.
 * Contribute to internal knowledge sharing and, where appropriate, technical blogs, webinars, or other industry content.
 * Support incident coordination during active incidents, providing clear updates and maintaining accurate investigation records.