> Markdown version of [/jobs/ext/3945068-incident-response-analyst](https://www.wearedevelopers.com/jobs/ext/3945068-incident-response-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Incident Response Analyst

- **Company:** Postaladdress
- **Location:** UK
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, User Authentication, Cyber Security, Digital Forensics, Event Logging
- **Published:** October 27, 2026
- **Apply:** https://startup.jobs/incident-response-analyst-check-point-software-10581682

## About the Role

* 5+ years of cybersecurity experience.
 * Minimum 2 years of hands-on DFIR/Incident Response experience investigating confirmed system or enterprise compromises.
 * Demonstrated experience conducting forensic investigations to determine:
 + Initial access and root cause
 + Persistence mechanisms
 + Credential compromise
 + Privilege escalation
 + Lateral movement
 + Attacker TTPs
 + Scope and impact of compromise
 * Hands-on experience analyzing Windows forensic artifacts, endpoint telemetry, event logs, authentication activity, and network evidence.
 * Experience responding to complex incidents such as ransomware, identity compromise, malware infections, and enterprise intrusions.
 * Ability to independently scope and drive an investigation and develop defensible remediation recommendations.
 * Strong experience producing customer-facing incident reports and presenting technical findings clearly.
 * Experience developing incident response plans and playbooks.
 * Strong analytical, troubleshooting, and communication skills.
 * Ability to work effectively during high-severity incidents requiring coordination across multiple teams and geographies.
 * Ability to participate in an on-call rotation, including at least one weekend per month.
 * Domestic and international travel may be required.

## Description

* Lead and perform end-to-end Incident Response and Digital Forensics investigations, from initial scoping through containment, forensic investigation, remediation, and final reporting.
 * Perform forensic analysis of compromised Windows and other enterprise systems to determine initial access, root cause, attacker activity, persistence, lateral movement, scope, and impact.
 * Analyze endpoint, operating system, authentication, network, and security telemetry to reconstruct attacker activity and identify indicators of compromise.
 * Lead response efforts during complex, large-scale, and global security incidents.
 * Perform enterprise-wide compromise assessments to identify affected systems and evidence of malicious activity.
 * Develop clear containment, eradication, recovery, and remediation recommendations.
 * Produce detailed, high-quality incident investigation reports documenting attack vectors, attacker TTPs, findings, impact, and recommended actions.
 * Clearly communicate technical findings and incident status to customer technical teams and senior stakeholders.
 * Develop and improve incident response plans, procedures, and playbooks.
 * Design realistic cyberattack scenarios and facilitate tabletop exercises.
 * Build and maintain forensic and malware-analysis lab environments.
 * Collaborate with global incident responders, forensic investigators, security researchers, and customer teams.