DFIR Consultant (Mid to Senior)

Senior DFIR Consultant and DFIR Consultant

Whether you lead critical incidents today or run your own forensic cases, there’s a level for you in this team. A global risk consultancy is growing its London digital forensics and incident response (DFIR) team and hiring at two levels. You’ll work across incident response, investigations and mobile forensics for law firms, Fortune 500 multinationals and government and law enforcement clients.

Senior DFIR Consultant and DFIR Consultant - The essentials

• £55,000 to £80,000, depending on level: Consultant £55,000 to £65,000, Senior £70,000 to £80,000
• London, hybrid with 2 days a week in the office
• Permanent, reporting to an Associate Director or Director, DFIR
• Up to 25% international travel, with some short-notice incident work

Senior DFIR Consultant and DFIR Consultant - What you’ll do

• Take cases end to end, from scoping and evidence collection through analysis and reporting
• Investigate incidents across Windows, Linux and macOS, Microsoft 365, Azure and AWS
• Turn technical evidence into clear, defensible reports, witness statements and client briefings
• Keep all work to an evidential standard, with detailed contemporaneous notes
• Share your expertise through research, articles and presentations
• At Senior level, also lead critical incidents, brief clients in crisis, coach the team and help shape the practice

Senior DFIR Consultant and DFIR Consultant - What you’ll need

Essential

• Hands-on DFIR casework in incident response or digital investigations
• Practical use of forensic tools such as X-Ways, Axiom, EnCase, FTK, Nuix, Velociraptor or Cellebrite
• Evidence handling to recognised standards such as NPCC, NIST, SANS or ISO 17025
• Scripting for log analysis in PowerShell, Python, Bash or SQL
• Clear written reporting for technical and non-technical readers

Nice to have

• Mobile device forensics, memory forensics, or cloud investigations in Microsoft 365 or AWS
• Expert reports, witness statements or courtroom skills training
• Certifications such as GCFA, GCFE, EnCE or ACE
• For the Senior role: experience leading incidents and developing other investigators

Where you might be coming from

Police or Forces digital forensics units, incident response consultancies, MSSPs, in-house CSIRT or forensic teams, or advisory forensic technology teams. If you meet most of the essentials but not all, we’d still like to hear from you.

What’s in it for you

• Varied casework across incident response, investigations and litigation
• A growing team with new investment behind it
• Room to build your profile through research and talks
• Hybrid working in a collaborative, inclusive international team

Apply

LT Harper is handling this search on behalf of our client. Apply directly on this advert, and don’t worry if you’re unsure which level fits, we’ll work it out together. If you have any questions, or would like to refer someone, contact Adam Sawa at a.sawa@ltharper.com.