Principal Consultant, Incident Response (Unit 42)

Overview

In this remote, client-facing role you lead reactive incident response engagements to contain and remediate security incidents, guiding customers through forensics and long-term posture improvement. You work with diverse stakeholders to deliver actionable remediation and collaborate across teams. The role combines technical forensics work with advisory leadership, shaping security outcomes for enterprise clients. You’ll mentor junior colleagues and represent deep expertise in incident response and digital forensics within a high-impact security team.

Responsibilities

• Lead and manage incident response engagements from scoping to containment and remediation
• Perform host-based analysis on Windows, Linux, and macOS to identify IOCs
• Analyze firewall, web, and database logs to uncover evidence and attack vectors
• Conduct data breach investigations using forensic tools to determine source and scope
• Provide actionable recommendations to improve clients’ long-term security posture
• Coordinate with internal and external stakeholders to deliver comprehensive solutions
• Mentor junior team members on incident response and forensics best practices

Key requirements

• Bachelor’s degree with 8 years’ experience, or Master’s with 6 years, or PhD with 3 years in information security or related field
• Direct incident response or digital forensics consulting experience
• Proficiency in host-based forensics and breach response methodologies
• Hands-on experience with forensic tools: EnCase, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, or Wireshark
• Willingness to travel up to 20%
• Eligibility for UK SC clearance essential

• Strong leadership abilities
• Excellent client-facing communication
• Relationship-building across internal and external teams
• Host-based forensics
• Incident response methodologies
• Forensic tools: EnCase, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, Wireshark

…