> Markdown version of [/jobs/ext/3793129-cyber-incident-response-consultant](https://www.wearedevelopers.com/jobs/ext/3793129-cyber-incident-response-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Incident Response Consultant - **Company:** UBDS Group - **Location:** London, UK - **Salary:** £66,313.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Amazon Web Services, Software System Penetration Testing, Cloud Computing Security, Cyber Security, Linux, Digital Forensics, Intrusion Detection and Prevention, Python (Programming Language), Microsoft Security Essentials, Network Architecture, Network Forensics, Windows PowerShell, Cloud Services, Anti-Phishing, Red Team (Cyber Security), Reverse Engineering, Security Log, Security Information and Event Management, EndPointSecurity, Data Logging, Scripting, Cloud Platform System, Mitre Att&ck, Malware, Cyber Threat Analysis, Cybercrime, Microsoft Sentinel, Network Server - **Published:** October 17, 2026 - **Apply:** https://www.adzuna.co.uk/jobs/details/5931137476 ## About the Role We're looking for someone with strong incident response experience, practical forensic investigation skills and the confidence to engage directly with customers. * Experience working within Cyber Incident Response, DFIR, SOC/SIOC or a similar cyber security environment. * Hands-on experience investigating and responding to cyber security incidents. * Experience supporting or leading customer-facing incident response engagements. * Strong experience with EDR tooling, SIEM platforms and security log analysis. * Understanding of incident response processes, including containment, eradication, recovery and lessons learned. * Practical knowledge of digital forensic techniques, including endpoint, memory, network or cloud forensics. * Experience collecting and preserving digital evidence, with an understanding of chain-of-custody principles. * Ability to analyse attacker activity, indicators of compromise and common attack techniques. * Good understanding of Windows, Linux, networking and cloud security. * Experience investigating security incidents within Microsoft and/or AWS environments. * Experience producing technical investigation reports and presenting findings to customers. * Strong analytical, investigative and problem-solving skills. * Excellent communication, stakeholder engagement and consultancy skills. Desirable Experience Experience across some of the following would be beneficial: * Microsoft Defender XDR, Defender for Endpoint and Microsoft Sentinel. * AWS security services, logging and incident investigation. * Digital forensic tooling such as Velociraptor, KAPE, Autopsy, Volatility or equivalent. * Malware analysis, reverse engineering or network forensics. * Threat intelligence, threat hunting and MITRE ATT&CK. * Experience supporting ransomware investigations and complex security incidents. * Designing and facilitating cyber incident tabletop exercises. * Developing realistic incident scenarios, injects and exercise objectives. * Evaluating exercise performance and producing post-exercise reports and recommendations. * Red Team, penetration testing or adversary simulation experience. * Python, PowerShell or scripting for investigation and automation. * Experience delivering cyber security consultancy services to external customers. * Experience working within Government, Defence or other regulated environments. Desirable Qualifications Relevant certifications or equivalent practical experience would be beneficial, including: * CREST Registered Incident Analyst (CRIA) or equivalent. * GIAC Certified Incident Handler (GCIH). * GIAC Certified Forensic Analyst (GCFA). * GIAC Certified Forensic Examiner (GCFE). * Microsoft Security Operations Analyst Associate (SC-200). * CompTIA CySA+, Security+ or equivalent. * Relevant SANS, CREST or other DFIR training. ## Description This is a hands-on, customer-facing consultancy role focused on investigating, responding to and recovering from cyber security incidents across complex customer environments. You will support and lead incident response engagements, conduct digital forensic investigations and advise customers on strengthening their cyber resilience and incident response capabilities. You will work primarily across Microsoft and AWS environments, alongside SIEM, EDR and digital forensic tooling. What You'll Do * Lead or support customer-facing cyber incident response engagements, from initial investigation through containment, eradication, recovery and reporting. * Investigate security incidents including ransomware, malware, phishing, account compromise and unauthorised access. * Conduct digital forensic investigations across endpoints, servers, cloud environments and network infrastructure. * Analyse security logs, endpoint telemetry, forensic artefacts and indicators of compromise to establish incident scope and root cause. * Use EDR, SIEM and forensic tooling to investigate suspicious activity and reconstruct attack timelines. * Advise customers on containment decisions, remediation priorities and recovery approaches. * Support eradication and recovery activities, validating remediation and identifying any remaining security risks. * Collect, preserve and document digital evidence, following appropriate forensic procedures and chain-of-custody requirements. * Produce professional incident investigation reports, including findings, timelines, root cause and remediation recommendations. * Present investigation findings and recommendations to technical teams, customers and senior stakeholders. * Support threat hunting, detection engineering and improvements to security monitoring capabilities. * Develop and improve incident response playbooks, processes and procedures. * Design and support cyber incident exercises, including tabletop scenarios, simulated incidents and response workshops. * Facilitate or contribute to exercises, evaluating response effectiveness and producing post-exercise recommendations. * Work closely with SIOC analysts, security engineers, cloud specialists and wider Managed Services colleagues during incidents. * Provide technical guidance and mentoring to less experienced security professionals., At UBDS Group our mission is to support entrepreneurs who are setting new standards with technology solutions across cloud services, cybersecurity, data and AI, ensuring that every investment advances our commitment to innovation, making a difference, and creating impactful solutions for organisations and society.