Incident Response Consultant (UK)
Role Overview
The Incident Response Consultant supports cyber security incident investigations and owns defined investigative workstreams with appropriate guidance.
The role provides technical analysis, customer guidance, and collaboration with SOC, MDR, Threat Intelligence, and wider cyber security teams.
The role develops practical expertise in Microsoft security technologies and telemetry.
The role participates in testing and safe adoption of AI-enabled Incident Response and MDR workflows.
Key Skills for This Role
Full Job Posting
About Quorum Cyber
Quorum Cyber is a cyber security company founded in Edinburgh in 2016 and serving customers across four continents.
The company operates as a Microsoft-first security provider and delivers services through its Clarity customer platform.
Incident Response supports managed security services and MDR customers when incidents require investigation, containment, remediation, or recovery.
Role purpose
The Incident Response Consultant supports cyber security incident investigations and owns defined investigative workstreams with appropriate guidance.
The role provides technical analysis, customer guidance, and collaboration with SOC, MDR, Threat Intelligence, and wider cyber security teams.
The role develops practical expertise in Microsoft security technologies and telemetry.
The role participates in testing and safe adoption of AI-enabled Incident Response and MDR workflows.
Incident investigation and analysis
- Investigate cyber security incidents across diverse technologies and environments.
- Perform host, network, and memory forensics across Windows, Linux, macOS, and multi-cloud environments.
- Identify threat actor tools, tactics, and procedures.
- Analyse logs, network traffic, disk images, and volatile artefacts to establish intent, activity, timelines, and impact.
- Maintain evidence documentation and chain-of-custody standards.
- Monitor emerging threats, malware families, and threat actor behaviours.
- Use incident lessons learned to improve detection, escalation, containment, response, and recovery processes.
- Coordinate investigations with SOC, MDR, Threat Intelligence, and other specialist teams.
Microsoft and AI-enabled security
- Apply Microsoft security technologies and telemetry to incidents affecting Microsoft-centric environments.
- Participate in testing, validation, and operationalisation of agentic AI-enabled Incident Response and MDR workflows.
- Review AI-generated findings, investigative recommendations, and response actions using evidence and defined processes.
- Identify opportunities to use AI and automation to improve investigation and response quality.
Customer engagement
- Act as a technical point of contact for customers during incidents.
- Communicate investigative findings, recommendations, and next steps clearly to technical and non-technical audiences.
- Engage with customer stakeholders, legal teams, technical staff, and executive leadership during incidents.
Workplace
- The role is advertised as remote in the United Kingdom.
Requirements
- Working knowledge of Microsoft security technologies and telemetry for investigating incidents in Microsoft-centric environments.
- Ability to perform host, network, and memory forensic analysis across Windows, Linux, macOS, and multi-cloud environments.
- Ability to analyse logs, network traffic, disk images, and volatile artefacts to establish attacker activity, timelines, and impact.
- Knowledge of evidence collection, documentation, and chain-of-custody best practices.
- Ability to communicate investigative findings and recommendations to technical and non-technical customer stakeholders.
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career