Senior Digital Forensics & Incident Response Consultant, NTT DATA
Salary not provided
AWS
Kubernetes
GCP
macOS
iOS
Linux
Android
Splunk
ELK
Azure
Windows
Powershell
Senior and Expert level
London
Potential travel
Office located in Royal Exchange, London
Digital transformation consulting and services
Be an early applicant
Digital transformation consulting and services
1001+ employees
B2BConsultingCloud Computing
Be an early applicant
Salary not provided
AWS
Kubernetes
GCP
macOS
iOS
Linux
Android
Splunk
ELK
Azure
Windows
Powershell
Senior and Expert level
London
Potential travel
Office located in Royal Exchange, London
1001+ employees
B2BConsultingCloud Computing
Company mission
To leverage information technology to create new paradigms and values, which help contribute to a more affluent and harmonious society.
Role
Who you are
- We're looking for passionate, curious, and motivated individuals to join our team
- Please note, you will need to be eligible for SC clearance
- Mastery of forensic analysis across multiple operating systems (Windows, Linux, macOS, mobile)
- Expert knowledge of disk forensics, file system analysis, and data recovery techniques
- Advanced memory forensics and volatile data analysis capabilities
- Deep understanding of network forensics and packet analysis for investigations
- Comprehensive knowledge of cloud forensics and container investigation techniques
- Forensic suites: EnCase, FTK, X-Ways Forensics, Autopsy, SIFT Workstation
- Memory forensics: Volatility, Rekall, WinDbg, memory imaging tools
- Network forensics: Wireshark, NetworkMiner, Zeek, tcpdump, packet analysis
- Malware analysis: IDA Pro, Ghidra, OllyDbg, x64dbg, Cuckoo Sandbox, REMnux
- Mobile forensics: Cellebrite, Magnet AXIOM, iOS and Android forensic tools
- EDR platforms: CrowdStrike Falcon, Carbon Black, Microsoft Defender, SentinelOne
- SIEM and logging: Splunk, ELK Stack, Azure Sentinel, log analysis and correlation
- Threat hunting: YARA rules, Sigma rules, threat hunting frameworks and methodologies
- IR tools: Velociraptor, KAPE, GRR Rapid Response, PowerShell forensics
- Cloud forensics: AWS CloudTrail, Azure Monitor, GCP Cloud Logging, cloud IR tools
- Operating systems: Deep Windows internals, Linux forensics, macOS artifacts, registry analysis
- File systems: NTFS, ext4, APFS, FAT, artifact analysis and timeline reconstruction
- Networking: TCP/IP, network protocols, proxy logs, firewall analysis
- Malware techniques: Packing, obfuscation, anti-analysis, persistence mechanisms
- Cloud platforms: AWS, Azure, GCP architecture and forensic artifact locations
- Independent problem-solving for complex and novel forensic challenges
- Analytical thinking and attention to detail in evidence analysis
- Calm and methodical approach during high-stress incident response situations
- Strong written communication for forensic reports and legal documentation
- Mentoring and knowledge transfer to junior forensic analysts
- GCFA (GIAC Certified Forensic Analyst) or GCFE (GIAC Certified Forensic Examiner) - Mandatory
- GREM (GIAC Reverse Engineering Malware) or CHFI (Computer Hacking Forensic Investigator) - Preferred
- GCIH (GIAC Certified Incident Handler) or ECIH (EC-Council Certified Incident Handler) - Preferred
- EnCE (EnCase Certified Examiner) or vendor forensic tool certification - Beneficial
- Eligible: UK SC security clearance (DV clearance advantageous)
- Bachelor's degree in Computer Science, Digital Forensics, Cybersecurity, Computer Engineering, or related field
- Master's degree in Digital Forensics or Cybersecurity preferred
- Advanced professional certifications in digital forensics and incident response
- 6+ years of progressive experience in digital forensics, incident response, or cyber investigations
- 3+ years leading complex forensic investigations and major incident response engagements
- Proven track record conducting forensic analysis for legal proceedings or regulatory investigations
- Experience with advanced threat actors, APT investigations, or nation-state incidents
- Hands-on expertise with enterprise EDR, SIEM, and forensic analysis platforms
- GCFA or GCFE demonstrating advanced digital forensic capabilities
- GREM for malware analysis and reverse engineering expertise
- GCIH for incident handling and response leadership
- Continuous professional development in emerging forensic techniques and threat landscape
What the job involves
- Using your advanced expertise in digital forensics, incident response, and cyber threat investigation, you will lead complex DFIR engagements, conduct advanced forensic analysis across diverse platforms, and provide authoritative guidance during major security incidents
- You will work independently on sophisticated investigations, coordinate multi-disciplinary incident response activities, and deliver expert testimony and forensic reporting while mentoring junior investigators and analysts
- Lead complex digital forensic investigations across Windows, Linux, macOS, mobile, and cloud platforms
- Conduct advanced disk, memory, network, and malware forensic analysis with minimal supervision
- Perform forensically sound evidence acquisition from diverse systems and environments
- Analyze complex attack chains, lateral movement, and advanced persistent threat activities
- Reconstruct incident timelines and attacker methodologies from forensic artifacts
- Provide expert forensic analysis for legal proceedings, regulatory investigations, and internal reviews
- Lead major incident response engagements for sophisticated cyber attacks and data breaches
- Coordinate multi-team incident response activities across technical, legal, and business stakeholders
- Perform advanced threat hunting, containment, eradication, and recovery activities
- Develop and execute incident response strategies for complex security events
- Interface with executive leadership, legal counsel, and regulatory bodies during major incidents
- Conduct post-incident reviews and develop remediation roadmaps
- Conduct static and dynamic malware analysis on sophisticated threats and custom malware
- Perform reverse engineering of malicious code to understand capabilities and attribution
- Analyze exploitation techniques, persistence mechanisms, and command and control infrastructure
- Develop indicators of compromise (IOCs) and detection signatures from malware analysis
- Document malware behavior, capabilities, and remediation procedures
- Contribute to threat intelligence with malware analysis findings and IOCs
- Lead forensic investigations in cloud environments including AWS, Azure, and GCP
- Conduct container and Kubernetes forensic analysis for cloud-native incidents
- Analyze cloud logs, API calls, and identity activity for security investigations
- Perform forensic acquisition and analysis of cloud workloads and serverless environments
- Investigate cloud-specific attack vectors including misconfigurations and identity compromise
- Develop cloud forensic methodologies and investigation playbooks
- Analyze threat actor tactics, techniques, and procedures (TTPs) using MITRE ATT&CK framework
- Conduct threat attribution analysis based on forensic artifacts and intelligence sources
- Correlate internal incident data with external threat intelligence feeds
- Identify advanced persistent threat campaigns and targeted attack patterns
- Develop tactical and strategic threat intelligence from investigation findings
- Share threat intelligence with industry partners and information sharing communities
- Provide expert witness testimony in legal proceedings and regulatory investigations
- Prepare forensic reports meeting legal and regulatory evidentiary standards
- Work with legal teams on e-discovery, litigation support, and regulatory response
- Maintain chain of custody and forensic integrity throughout investigations
- Present technical findings to non-technical audiences including courts and regulators
- Support law enforcement and regulatory agencies with cyber investigations
- Senior-level communication with executives, legal teams, and regulatory bodies
- Crisis management and calm leadership during high-pressure security incidents
- Ability to translate complex technical findings into business impact assessments
- Coordination of cross-functional teams during major incident response
- Presentation skills for delivering findings to diverse stakeholder audiences
- Lead major incident response operations and forensic investigations
- Develop forensic methodologies and incident response playbooks
- Provide expert guidance during crisis situations and security breaches
- Contribution to digital forensics research and methodology development
- Speaking engagements at DFIR, incident response, and cybersecurity conferences
- Publication of forensic research, case studies, and technical analysis
- Active participation in forensic and incident response communities
- Contribution to open-source forensic tools and detection content
- High-pressure incident response environment requiring rapid mobilization
- On-call rotation for major security incidents and breach response
- Mix of proactive forensic investigations and reactive incident response
- Regular interaction with executive leadership during crisis situations
- Potential travel to client sites for on-site forensic acquisition and incident response
- Hybrid working model with flexibility for emergency incident response
- KEY PERFORMANCE INDICATORS:
- Successful resolution of complex digital forensic investigations with actionable findings
- Client satisfaction scores for DFIR engagements and incident response leadership (target: 4.5/5.0+)
- Quality and accuracy of forensic analysis and investigation reports
- Effective incident containment and recovery with minimal business impact
- Contribution to DFIR methodologies, tools, and threat intelligence
- Professional recognition through certifications, speaking engagements, or research publications
Salary benchmarks
Our take
The changes brought on by digitisation have only accelerated in the past few decades, and large organisations have been struggling to keep up. Attracting future investment and ensuring growth is more than a matter of purchasing new tools, it involves a fundamental change in ways of working and company culture that few organisations have the expertise to achieve on their own. The UK and Ireland arm of NTT Data, a global digital transformation consultancy and services firm, exists to support businesses and government organisations through this seismic change.
With digital transformation at the top of most enterprises' agendas, NTT Data faces major competition in this sector from the likes of Deloitte, Accenture and IBM's consulting arm. However NTT Data UK & Ireland brings significant local expertise particularly in UK telecommunications, financial services and the British public sector which gives them an edge in this market.
NTT Data UK&I has ambitious plans to capture 2% of the total digital transformation market in the UK, a sector which was worth £20 billion in 2022 and is projected to increase rapidly year on year. To achieve this it has formed strategic partnerships with infrastructure providers such as Google Cloud, allowing it to offer multi-cloud solutions as part of its suite of services to its clients. If it can leverage the size and expertise of its parent organisation successfully while still retaining its local advantages, it is well placed to achieve this goal.
Steph
Company Specialist at Welcome to the Jungle
Insights
6% employee growth in 12 months
Company
Company benefits
- A people focused business
- Excellent opportunities to grow your career, including an online training platform with 3000+ courses, accessible from everywhere, to sharpen your skills
- A varied client base
Company HQ
London, UK
Leadership
Fernando Apezteguia
(Business Development and Value Creation NTT DATA UK)Was Market Unit Lead UK with NTT DATA before stepping up to the role of CEO of NTT DATA UK. Previously CEO of everis in Brazil and SAP specialist with El Corte Inglés.
Share this job
View 30 more jobs at NTT DATA