Job description
About the job
DFIR Engineer - UK remote - £65,000 - £95,000 + Benefits + Bonus
Our client is scaling their DFIR capability and is seeking highly advanced DFIR Engineers to join their elite security team. This role is designed for technical specialists who thrive in complex investigations, advanced threat scenarios, and large scale incident response. You will be at the forefront of digital forensics, reverse engineering, and cyber defence, working across enterprise, cloud, and hybrid environments.
Main responsibilities
Lead response to advanced intrusions/APTs, insider threats
Perform forensic acquisition & analysis (disk, memory, cloud, mobile)
Reverse engineer malware, develop detection rules (YARA, signatures)
Hunt threats, build detections in SIEM/EDR (Splunk, Elastic, CrowdStrike, etc.)
Develop custom tooling/scripts (Python, PowerShell, Go)
Mentor team, contribute playbooks/runbooks
Skills & Experience
5+ years DFIR - Must be strong in BOTH Digital Forensice & Incident Response
Deep OS internals (Windows, Linux, macOS), network protocols, cloud security
Volatility, X-Ways, Magnet AXIOM, GRR, IDA Pro, Ghidra, Zeek, Sysmon
Strong scripting/programming (Python, PowerShell, Bash, Go)
Preferred certs: GCFA, GNFA, GREM, OSCP/OSEE
Originally posted on Himalayas
Who can apply
Eligible countries: United States. Accepted UTC offsets: UTC-10, UTC-9, UTC-8, UTC-7, UTC-6, UTC-5, UTC+14. Review the full description for employer-specific work authorization, residency and schedule requirements.