Incident Response Specialist

Incident Response Specialist

PH - Fully Remote

The Incident Response Specialist will play a key role in supporting customers through all stages of a cyber incident, from initial investigation through to containment, eradication, recovery and post-incident reporting.

Working alongside senior Incident Responders and Incident Managers, you will conduct technical investigations, analyse evidence, identify attacker activity and support customers during some of their most critical cyber security events.

The role also supports proactive security services including Incident Response Readiness Assessments, Tabletop Exercises, Threat Hunting and Threat Intelligence activities.

This is an excellent opportunity for an experienced SOC Analyst or early-career Incident Responder looking to develop into a senior DFIR consultant.

What You'll Do

Incident Response

• Investigate cyber security incidents affecting customer environments.
• Analyse endpoint, network, cloud and identity-based evidence.
• Perform host-based investigations across Windows and Microsoft 365 environments.
• Support containment, eradication and recovery activities.
• Identify attacker tactics, techniques and procedures (TTPs) using the MITRE ATT&CK framework.
• Collect, preserve and analyse forensic artefacts where appropriate.
• Produce Indicators of Compromise (IOCs) and detection recommendations.
• Support evidence collection for regulatory or legal requirements.

Technical Investigation

• Analyse Microsoft Defender XDR telemetry.
• Investigate Microsoft Sentinel incidents.
• Review Windows Event Logs and Sysmon data.
• Analyse Entra ID sign-in and audit logs.
• Investigate Exchange Online activity.
• Perform malware triage and basic static analysis.
• Review firewall, proxy, VPN and authentication logs.
• Conduct threat hunting activities across customer environments.

Customer Engagement

• Participate in customer investigation calls.
• Explain technical findings to both technical and non-technical audiences.
• Produce high-quality investigation reports.
• Provide remediation recommendations.
• Support post-incident lessons learned workshops.

Proactive Services

• Incident Response Readiness Assessments
• Tabletop Exercises
• Threat Hunting engagements
• Threat Intelligence services
• Security posture reviews
• AI security investigations where required

Continuous Improvement

• Develop new investigation playbooks.
• Improve Incident Response procedures.
• Contribute to internal knowledge sharing.
• Support development of detection content.
• Assist with automation opportunities using Microsoft and AI technologies.

Employees are expected to demonstrate a security-first mindset and ensure that information security considerations are incorporated into their day-to-day activities, decision-making, and interactions with customers, suppliers, and colleagues.

What We're Looking For

Essential

• Relevant experience in Cyber Security or Incident Response.
• Strong English communication skills.

Advantageous

• SC-200 Microsoft Security Operations Analyst
• SC-100 Cybersecurity Architect
• AZ-500 Microsoft Azure Security Technologies
• GCIH
• GCFA
• GNFA
• CompTIA Security+
• CREST Practitioner or equivalent