Incident Responder

About the role

You are engaged once an incident is already underway. The work is to establish the scope of the compromise, contain it without destroying evidence, determine the initial access route, and confirm whether the attacker still has access. The written timeline you produce is a deliverable in its own right: it is what the client presents internally and, in regulated sectors, to their regulator.

Responsibilities

• Scope and contain live incidents
• Reconstruct the intrusion from what the logs actually kept
• Write the timeline the client will read to their board

Requirements

• Host and network forensics on real cases
• Calm under other people's panic
• Writes fast and accurately when it counts

Skills

• GCFA or equivalent (nice to have)
• Malware analysis (nice to have)
• On-call experience (nice to have)