Incident Response/DFIR Analyst at LT Harper, London/Remote, £500-£600 per day

Incident Response Analyst (DFIR)

You’ll join the incident response team at an MSSP in a hands-on DFIR role, taking incidents across a range of client environments from first alert through containment, digital forensics and lessons learned. You’ll also be the person clients turn to during an incident, guiding them through it and presenting what you found once it’s resolved.

The essentials

• £500 - £600 per day, Outside IR35
• London, 2 days a week on site
• Contract role, client-facing, working alongside Security Operations, Professional Services and Customer Success teams

What you’ll actually do

• Triage and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network platforms, then set severity and escalate against client service levels
• Lead or support investigations into phishing, malware, account compromise, data loss and unauthorised access, coordinating containment and recovery with client stakeholders
• Lead client communications through each incident, giving clear technical guidance and regular updates, then run review meetings to present findings and lessons learned
• Carry out DFIR work across host, network, email and cloud artefacts, maintaining chain of custody and mapping findings to MITRE ATT&CK
• Run intelligence-led threat hunts and build or tune detection content to close gaps found during incidents
• Maintain playbooks and runbooks, run post-incident reviews and support tabletop exercises

What you’ll need

Essential

• Hands-on DFIR, incident response, SOC or cyber defence experience
• Investigating incidents with SIEM and EDR/XDR tools
• Analysing Windows and Linux systems, authentication events, network traffic and security logs
• A solid grasp of the incident response lifecycle and frameworks such as MITRE ATT&CK and NIST
• Understanding of evidence handling and forensic methodology
• Clear communication with clients and senior stakeholders, and sound judgement under pressure

Nice to have

• Experience in an MSSP, consultancy, financial services, critical infrastructure or other regulated environment
• Microsoft Sentinel, Defender XDR, Defender for Identity or Defender for Cloud
• Scripting or querying in KQL, Python or PowerShell
• Forensic tools such as Velociraptor, Volatility, EnCase, FTK or Wireshark, or certifications such as GCIH, GCFA or SC-200

What’s in it for you

Variety. Every client environment is different, and the role covers the whole incident lifecycle, from detection and forensics through to threat hunting, detection engineering and helping shape how the incident response service develops.