Incident Response Analyst- Contract- Outside ir35 (London, ENG)
Summary
12-month contract (outside IR35, £450/day) for an Incident Response Analyst, hybrid with 2 days onsite in London. Day to day: investigating security alerts in a SOC-style function using SIEM and EDR/XDR, analysing host artefacts, logs and network traffic, and driving the incident response lifecycle through reporting and post-incident review.
Incident Response Analyst- Contract- Outside ir35
Rate- £450 per day, outside IR35
Location- 2 days onsite (London), 3 days’ work from home
Duration- 12-month contract.
Incident Response Analyst
Practical experience in cyber incident response, security monitoring or a Security Operations Centre environment.
• Hands-on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
• Working knowledge of incident response lifecycle activities, including preparation, detection, analysis, containment, eradication, recovery and lessons learned.
• Experience producing incident records, investigation reports, management updates and post-incident findings.
• Understanding of attacker behaviours and frameworks, including MITRE ATT&CK, Cyber Kill Chain and NIST incident response guidance.
• Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint security, vulnerability management and data loss prevention.
• Ability to manage multiple priorities, exercise sound judgement under pressure and communicate clearly with technical and senior stakeholders.
• Awareness of evidence handling, forensic integrity, confidentiality and regulatory considerations relevant to cyber investigations.
• Experience with threat intelligence, malware analysis, scripting or automation using PowerShell, Python, KQL or similar languages.
• Relevant professional experience supported by a degree in cyber security, computer science or a related discipline, or equivalent practical experience.
• One or more relevant certifications such as GCIH, GCIA, GCFA, GNFA, SC-200, CySA+, CISSP or equivalent are desirable.