{"id":2750313,"url":"https://alion.io/job/ubds-digital-cyber-incident-response-consultant","title":"Cyber Incident Response Consultant","company":{"id":8401,"name":"UBDS Digital","domain":"ubdsdigital.com","url":"https://alion.io/company/ubds-digital","size_band":null,"is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":89,"open_postings":7,"ghost_share":0,"stale_share":0.429,"repost_share":0,"time_to_fill_p50_days":31,"computed_at":"2026-11-05T05:54:30Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom","Manchester, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":63000,"max_usd":144000,"period":"year","method":"role_country_seniority_unknown","sample_n":159},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Linux","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"Autopsy","optional":true},{"name":"KAPE","optional":true},{"name":"Microsoft Defender","optional":true},{"name":"Microsoft Sentinel","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Red Teaming","optional":true},{"name":"Velociraptor","optional":true},{"name":"Volatility","optional":true}],"status":"live","first_seen_at":"2026-10-16T23:49:37Z","employer_posted_date":"2026-10-16","last_verified_at":"2026-11-05T19:38:15Z","board_verified":true,"closed_at":null,"days_open":20,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":20},"description":"At UBDS, we help organisations transform through cloud, cyber security, AI and digital innovation. As our Managed Services capability continues to grow, we're looking for an experienced Cyber Incident Response Consultant to join our Security and Infrastructure Operations Centre (SIOC), based in either London or Manchester.\nThis is a hands-on, customer-facing consultancy role focused on investigating, responding to and recovering from cyber security incidents across complex customer environments. You will support and lead incident response engagements, conduct digital forensic investigations and advise customers on strengthening their cyber resilience and incident response capabilities.\nYou will work primarily across Microsoft and AWS environments, alongside SIEM, EDR and digital forensic tooling.\nWhat You'll Do\nLead or support customer-facing cyber incident response engagements, from initial investigation through containment, eradication, recovery and reporting.\nInvestigate security incidents including ransomware, malware, phishing, account compromise and unauthorised access.\nConduct digital forensic investigations across endpoints, servers, cloud environments and network infrastructure.\nAnalyse security logs, endpoint telemetry, forensic artefacts and indicators of compromise to establish incident scope and root cause.\nUse EDR, SIEM and forensic tooling to investigate suspicious activity and reconstruct attack timelines.\nAdvise customers on containment decisions, remediation priorities and recovery approaches.\nSupport eradication and recovery activities, validating remediation and identifying any remaining security risks.\nCollect, preserve and document digital evidence, following appropriate forensic procedures and chain-of-custody requirements.\nProduce professional incident investigation reports, including findings, timelines, root cause and remediation recommendations.\nPresent investigation findings and recommendations to technical teams, customers and senior stakeholders.\nSupport threat hunting, detection engineering and improvements to security monitoring capabilities.\nDevelop and improve incident response playbooks, processes and procedures.\nDesign and support cyber incident exercises, including tabletop scenarios, simulated incidents and response workshops.\nFacilitate or contribute to exercises, evaluating response effectiveness and producing post-exercise recommendations.\nWork closely with SIOC analysts, security engineers, cloud specialists and wider Managed Services colleagues during incidents.\nProvide technical guidance and mentoring to less experienced security professionals.\nWhat We're Looking For\nWe're looking for someone with strong incident response experience, practical forensic investigation skills and the confidence to engage directly with customers.\nExperience working within Cyber Incident Response, DFIR, SOC/SIOC or a similar cyber security environment.\nHands-on experience investigating and responding to cyber security incidents.\nExperience supporting or leading customer-facing incident response engagements.\nStrong experience with EDR tooling, SIEM platforms and security log analysis.\nUnderstanding of incident response processes, including containment, eradication, recovery and lessons learned.\nPractical knowledge of digital forensic techniques, including endpoint, memory, network or cloud forensics.\nExperience collecting and preserving digital evidence, with an understanding of chain-of-custody principles.\nAbility to analyse attacker activity, indicators of compromise and common attack techniques.\nGood understanding of Windows, Linux, networking and cloud security.\nExperience investigating security incidents within Microsoft and/or AWS environments.\nExperience producing technical investigation reports and presenting findings to customers.\nStrong analytical, investigative and problem-solving skills.\nExcellent communication, stakeholder engagement and consultancy skills.\nDesirable Experience\nExperience across some of the following would be beneficial:\nMicrosoft Defender XDR, Defender for Endpoint and Microsoft Sentinel.\nAWS security services, logging and incident investigation.\nDigital forensic tooling such as Velociraptor, KAPE, Autopsy, Volatility or equivalent.\nMalware analysis, reverse engineering or network forensics.\nThreat intelligence, threat hunting and MITRE ATT&CK.\nExperience supporting ransomware investigations and complex security incidents.\nDesigning and facilitating cyber incident tabletop exercises.\nDeveloping realistic incident scenarios, injects and exercise objectives.\nEvaluating exercise performance and producing post-exercise reports and recommendations.\nRed Team, penetration testing or adversary simulation experience.\nPython, PowerShell or scripting for investigation and automation.\nExperience delivering cyber security consultancy services to external customers.\nExperience working within Government, Defence or other regulated environments.\nDesirable Qualifications\nRelevant certifications or equivalent practical experience would be beneficial, including:\nCREST Registered Incident Analyst (CRIA) or equivalent.\nGIAC Certified Incident Handler (GCIH).\nGIAC Certified Forensic Analyst (GCFA).\nGIAC Certified Forensic Examiner (GCFE).\nMicrosoft Security Operations Analyst Associate (SC-200).\nCompTIA CySA+, Security+ or equivalent.\nRelevant SANS, CREST or other DFIR training.\nThe Opportunity\nBased in London or Manchester, you'll join our growing Managed Services capability, working alongside experienced cyber security, cloud and infrastructure professionals within our SIOC.\nYou'll gain exposure to a broad range of customer environments, complex cyber investigations and digital forensic activities, while playing an important role in helping customers respond to and recover from security incidents.\nYou'll also have the opportunity to help develop UBDS's DFIR and incident response consultancy capability, shaping investigation processes, improving customer response readiness and supporting the continued growth of our Managed Services offering.\nBenefits\nWhy people choose to grow their careers at UBDS Group\nProfessionals choose to grow their careers at UBDS Group for its reputation as a dynamic and forward-thinking organisation that is deeply committed to both innovation and employee development. At UBDS Group, employees are given unique opportunities to work on cutting-edge projects across a diverse range of industries, exposing them to new challenges and learning opportunities that are pivotal for professional growth. The Group’s culture emphasises continuous improvement, offering ample training programs, mentorship, and the chance to gain certifications that enhance their skills and marketability.\nUBDS Group fosters a collaborative environment where creativity and innovation are encouraged, allowing employees to contribute ideas and solutions that have a tangible impact on the company and its clients. This combination of professional development, a culture of innovation, and the opportunity to make meaningful contributions makes UBDS Group an attractive place for those looking to advance their careers and be at the forefront of technological and operational excellence.\nEmployee Benefits\n Training - All team members are offered a number of options in terms of personal development, whether it is technical led, business acumen or methodologies. We want you to grow with us and to help us achieve more\n Private medical cover for you and your spouse/partner, offered via Vitality\n Discretionary bonus based on a blend of personal and company performance\n Holiday - You will receive 25 Days holiday, plus 1 day for Birthday and 1 day for your work anniversary in addition to UK bank holidays\n Electric Vehicle leasing with salary sacrifice\n Contributed Pension Scheme\n Death in service cover\n About UBDS Group\nAt UBDS Group our mission is to support entrepreneurs who are setting new standards with technology solutions across cloud services, cybersecurity, data and AI, ensuring that every investment advances our commitment to innovation, making a difference, and creating impactful solutions for organisations and society.\nEqual Opportunities\nWe are an equal opportunities employer and do not discriminate on the grounds of gender, sexual orientation, marital or civil partner status, pregnancy or maternity, gender reassignment, race, colour, nationality, ethnic or national origin, religion or belief, disability or age.","description_format":"text","description_chars":8489,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","IT Consulting & Digital Transformation","Cloud Consulting & Migration"],"lifecycle":[{"event":"open","at":"2026-10-16T23:49:37Z"}],"visa":[],"liveness":{"score":73,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.809,"p_room":0.9,"age_days":19,"expected_fill_days":31,"reasons":["conf:1","velocity","win:mid"],"computed_at":"2026-11-05T05:54:30Z"},"pay":null,"html_url":"https://alion.io/job/ubds-digital-cyber-incident-response-consultant","json_url":"https://alion.io/job/ubds-digital-cyber-incident-response-consultant.json","meta":{"generated_at":"2026-11-06T00:06:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":281,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8401},"rest":"https://alion.io/mcp/rest/get_company?id=8401"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fubds-digital-cyber-incident-response-consultant"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fubds-digital-cyber-incident-response-consultant"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fubds-digital-cyber-incident-response-consultant"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ubds-digital-cyber-incident-response-consultant\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fubds-digital-cyber-incident-response-consultant"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2750313}},{"tool":"search_jobs","arguments":{"company":"ubdsdigital.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2750313},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}