{"id":3339193,"url":"https://alion.io/job/control-risks-cyber-incident-response-consultant","title":"Cyber Incident Response Consultant","company":{"id":6732,"name":"Control Risks","domain":"controlrisks.com","url":"https://alion.io/company/control-risks","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":85,"open_postings":18,"ghost_share":0,"stale_share":0.611,"repost_share":0,"time_to_fill_p50_days":39,"computed_at":"2026-10-29T05:49:05Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":54000,"max_usd":123000,"period":"year","method":"role_country_seniority_unknown","sample_n":159},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":true},{"name":"YARA","optional":true},{"name":"YARA","optional":true}],"status":"live","first_seen_at":"2026-10-27T14:55:38Z","employer_posted_date":"2026-10-27","last_verified_at":"2026-10-29T16:31:53Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Thanks to continued growth, we are now looking for a Cyber Incident Response Consultant to join us in our London office. As the Cyber Incident Response Consultant you will be responsible for delivering Control Risks' Cyber Incident Response projects for clients. Working as part of a team on high-profile incidents, you will undertake compromise assessments and business email compromise investigations, as well as investigate and help lead the technical response to complex cases, including ransomware attacks. The role also contributes to developing the investigative toolsets and automation used by the practice. Reporting to an Associate Director of Cyber Response, you will work closely with the Cyber Crisis Management team. The successful candidate will have an incident response background; technical expertise spanning infrastructure, web servers and cloud environments; a deep understanding of current and emerging threat actors; and a genuine interest in developing tooling that improves the delivery of investigations. Please note that this role will require you to work at least three days per week from our London office on a hybrid basis.\nTasks and Responsibilities\nIncident Response\nAs part of the cyber incident response team leading and assisting with host, network, web server and cloud-based investigations into complex cyber incidents, including ransomware attacks. \nInvestigate incidents affecting SaaS platforms and software development environments (e.g. source code repositories and CI/CD pipelines), drawing on an understanding of common development practices. \nThreat hunting and identification of attacker activity, using EDR and agent-led forensic tooling, to inform the investigation and containment activities \nPerform live compromise assessments for organisations who suspect live and ongoing system intrusion. \nDetect and hunt unknown live, dormant, and custom malware in memory across multiple systems in an enterprise environment. \nContribute to the design and development of investigative toolsets and automation, and assist with commercialising the technology developed to ensure it is fit for purpose. \nDemonstrate an understanding of both existing and emerging threat actors, as well as experience identifying rapidly changing tools, tactics and procedures of attackers. \nWork with the Cyber Threat Intelligence team to identify where they could benefit from the technical information acquired during Cyber Response cases. Also identify and implement where threat intelligence can be leveraged through tooling and automation. \nAdvise on the safe technical recovery of an organisations IT systems balancing the need to understand what has happened but speed up recovery.\nClient Management\nEnsure tooling and automation developed is customer friendly to deploy and use. Be responsible for any customer queries that arise from the use of the technology and automation. \nReporting\nProvide situation reports and other significant case related material to the client, case lead, and team leadership. \nProvide documentation to the relevant consultants in sufficient time to allow review and feedback, before submitting to a client. \nContribute to high quality client reports highlighting technical findings in a structured and defensible manner. \nSupporting the growth of the Cyber Response practice\nDiscuss and input into Control Risks’ cyber response methodologies and approaches whilst tailoring the approach in changing market conditions. \nThis role has a requirement to join the team’s on call duty rota. \nIdentifying potential new areas of growth and opportunity.\nRequirements\nEssential\nProven experience investigating complex cyber incidents, including ransomware attacks, as part of an incident response team \nTechnical degree or demonstrated knowledge of common networks, software and hardware used in business environments \nStrong understanding of enterprise infrastructure, web servers and cloud environments (e.g. Microsoft Azure / Entra ID, AWS, Google Cloud), including how they are attacked and investigated \nExperience in conducting log analysis and digital forensics following a cyber incident \nProven experience in responding to cyber-attacks \nFluent in English (written and spoken) \nExcellent presentation skills \nExcellent analytical skills \nScripting and or development experience \nDemonstrable investigative mindset and independent research of complex incidents and interest in developing investigative toolsets and automation to support and enhance our cyber incident response practice\nPreferred Qualifications and specialist skills\nStrong understanding of MITRE ATT&CK techniques / sub-techniques. The ability to articulate TTPs to clients in non-technical terms. \nExperience in generating SIGMA rules for host detection, SNORT rules for network detection and YARA Signatures for file and memory artefact identification. \nGeneral understanding of common SaaS platforms and software development practices (e.g. source control, CI/CD pipelines, APIs), sufficient to investigate incidents affecting these environments.\nBenefits\n Control Risks offers a competitively positioned compensation and benefits package that is transparent and summarised in the full job offer.\n We operate a discretionary global bonus scheme that incentivises, and rewards individuals based on company and individual performance.\n Control Risks supports hybrid working arrangements, wherever possible, that emphasise the value of in-person time together - in the office and with our clients - while continuing to support flexible and remote working.\n As an equal opportunities employer, we encourage suitably qualified applicants from a wide range of backgrounds to apply and join us and are fully committed to equal treatment, free from discrimination, of all candidates throughout our recruitment process. \n If you require any reasonable adjustments to be made in order to participate fully in the interview process, please let us know and we will be happy to accommodate your needs.","description_format":"text","description_chars":6013,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Hybrid work"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Services","Management Consulting"],"lifecycle":[{"event":"open","at":"2026-10-27T14:55:38Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Skilled Worker, Senior or Specialist Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Skilled Worker; Global Business Mobility: Senior or Specialist Worker","cap_exempt":false,"checked_at":"2026-10-29T06:20:15+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":1,"expected_fill_days":39,"reasons":["conf:2","stale_co","velocity","win:early"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/control-risks-cyber-incident-response-consultant","json_url":"https://alion.io/job/control-risks-cyber-incident-response-consultant.json","meta":{"generated_at":"2026-10-29T20:05:18Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":29889,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6732},"rest":"https://alion.io/mcp/rest/get_company?id=6732"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcontrol-risks-cyber-incident-response-consultant"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcontrol-risks-cyber-incident-response-consultant"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcontrol-risks-cyber-incident-response-consultant"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/control-risks-cyber-incident-response-consultant\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcontrol-risks-cyber-incident-response-consultant"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3339193}},{"tool":"search_jobs","arguments":{"company":"controlrisks.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3339193},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}