DFIR Engineer

About the job

DFIR Engineer - UK remote - £65,000 - £95,000 + Benefits + Bonus

Our client is scaling their DFIR capability and is seeking highly advanced DFIR Engineers to join their elite security team. This role is designed for technical specialists who thrive in complex investigations, advanced threat scenarios, and large scale incident response. You will be at the forefront of digital forensics, reverse engineering, and cyber defence, working across enterprise, cloud, and hybrid environments.

Main responsibilities

• Lead response to advanced intrusions/APTs, insider threats
• Perform forensic acquisition & analysis (disk, memory, cloud, mobile)
• Reverse engineer malware, develop detection rules (YARA, signatures)
• Hunt threats, build detections in SIEM/EDR (Splunk, Elastic, CrowdStrike, etc.)
• Develop custom tooling/scripts (Python, PowerShell, Go)
• Mentor team, contribute playbooks/runbooks

Skills & Experience

• 5+ years DFIR - Must be strong in BOTH Digital Forensice & Incident Response
• Deep OS internals (Windows, Linux, macOS), network protocols, cloud security
• Volatility, X-Ways, Magnet AXIOM, GRR, IDA Pro, Ghidra, Zeek, Sysmon
• Strong scripting/programming (Python, PowerShell, Bash, Go)
• Preferred certs: GCFA, GNFA, GREM, OSCP/OSEE