Lead Consultant - Incident Response

About the role

The Lead Consultant will head incident response engagements within a high‑impact cyber defence environment, working closely with a skilled blue‑team. You will combine deep forensic expertise with strong stakeholder communication to drive investigations and remediation.

Key responsibilities

• Serve as technical and coordination lead on active incident response engagements.
• Execute and coordinate threat‑hunting activities supporting IR and SOC operations.
• Perform host and network forensics across Windows, macOS, and Linux platforms.
• Lead the production of detailed reports and technical briefs for clients.
• Conduct quality‑assurance reviews of junior team members' reports.
• Maintain and develop the client‑fostered DFIR forensics lab.

Required profile

• Excellent English communication and stakeholder‑management skills.
• GIAC certification in at least one discipline (e.g., GNFA, GCIH, GCFA).
• Prior experience performing digital forensics; malware analysis experience is a plus.
• Bachelor’s degree in Computer Science or Engineering is desirable but not mandatory.

Required skills

• Strong understanding of blue‑team operations, threat hunting and the ATT&CK framework.
• Proficiency with forensic tools on Windows, Linux and macOS.
• Experience with network analysis tools such as Zeek (formerly Bro), Rita, Suricata.
• Knowledge of network protocols (TCP/IP) and log analysis.
• Ability to conduct static and dynamic malware analysis.
• Familiarity with AI security processes and their application in investigations.