{"id":2303820,"url":"https://alion.io/job/withsecure-incident-response-investigator","title":"Incident response investigator","company":{"id":56688,"name":"WithSecure","domain":"withsecure.com","url":"https://alion.io/company/withsecure","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Jobylon","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":62000,"max_usd":141000,"period":"year","method":"role_country_seniority_unknown","sample_n":140},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Windows","optional":false},{"name":"Bash","optional":true},{"name":"EnCase","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Ruby","optional":true},{"name":"X-Ways Forensics","optional":true}],"status":"live","first_seen_at":"2026-09-21T08:25:53Z","employer_posted_date":"2026-10-11","last_verified_at":"2026-10-19T21:34:29Z","board_verified":true,"closed_at":null,"days_open":28,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":28},"description":"WithSecure™ delivers research-led cyber security to defend organizations, society and people from real-world attacks and build resilience into their approach. Our people are a mix of technical and creative experts - diverse, talented, and passionate people - working tirelessly to help us advance the industry with new ways of thinking. They lead their own development, in and out of the office. They call the shots when it comes to building a place to call home in our organization.\nWithSecure™ protects businesses all over the world from modern threats. We do this through a Co-security approach born from first-hand knowledge that no one can solve every cyber security problem alone. Every single day, our diverse, growing team fights against online extortion, threats to national infrastructure, the unlawful spread of sensitive information, and everything in-between. The best part about working for WithSecure is our people! We are a community of dedicated and passionate professionals that take workplace happiness seriously. If you’re looking for something that’s more than just a job - we’d love to hear from you.\nThe role also requires the ability to clearly communicate to a range of audiences from technical practitioners through to executive boards. This requires the ability to identify technical issues and describe them in the language of the business leaders you are engaged with.\nA successful candidate should have an experience of both enterprise IT platforms and information security. They will be required to understand the motivations and methods adopted by a wide range of threat sources with a good understanding of how exploitation of systems occurs.\nIn addition, supporting Incident Readiness activities (such as Tabletop sessions, Client Training, and Playbook creation), when not actively supporting investigations.\nKey Responsibilities\nPerforming investigations for WithSecure clients and producing high quality reports to present findings and guidance.\nMaintaining target utilization on client chargeable projects whilst working as a Senior Incident Response Investigator.\nProducing output to highlight the technical competence of the company to a standard that can be published.\nSupporting your practice area in successful delivery and growth.\nMentoring juniors along with supporting key business objectives though advice and guidance based on current industry trends.\nWhat are we looking for?CISSP qualification or equivalent experience\nExperience with investigating targeted attacks across large enterprise networks\nDemonstrable experience of client-server infrastructures, security architectures and related logging and alerting across multiple operating systems\nDemonstrable experience networking with the ability to perform network forensic analysis down to packet level\nDemonstrable detailed knowledge of file-system analysis including FAT, NTFS, HFS+ and/or EXT2/3/4 and ability to find and extract common disk-based indicators of compromise\nKnowledge of Windows, Linux and/or OS X internals and able to demonstrate knowledge of key system artefacts for each platform\nAble to articulate the phases of Incident Response as defined by NIST\nFamiliarity MITRE ATT&CK Matrix for Enterprise framework\nKnowledge of and experience in memory analysis\nAbility to report key findings in a clear and concise manner both at technical and senior management level\n\nBonus points\nExperience in Malware Analysis to a minimum level of behavioral analysis\nFamiliarity with one or more scripting language such as Python, Ruby, PowerShell or Bash is desirable\nExperience of common cloud technologies\nVendor independent qualification in Incident Response and Forensics such as GIAC, IISFA, IACIS, ISFCE, ECCouncil or CREST certifications (e.g. CFCE, CCE, CIFI, CHFI, ECIH, GCIH, GCIA, GCFA, GCFE, GREM, GCED, Intrusion Analyst, Network or Host Intrusion Analyst or Malware Reverse Engineer)\nVendor specific qualification such as AccessData Certified Examiner (ACE), Encase Certified Examiner (EnCE) certification or X-Ways Professional in Evidence Recovery Techniques (X-PERT)\nDV-clearance\nChartered Cyber Security Professional-status (ChCSP)\nWhat will you get from us\nFreedom - you will have the opportunity to define new ways of working how we engage with our customers, and how product value gets represented.\nYou will work together with experienced and enthusiastic colleagues, and within WithSecure you will find some of the best minds in the cyber security industry.\nYour work will be clearly visible and recognised - all over the world and across our business units.","description_format":"text","description_chars":4588,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Cloud Security","Information Security","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-11T22:04:23Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Skilled Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Skilled Worker","cap_exempt":false,"checked_at":"2026-10-17T06:21:15+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":50,"band":"ok","label":"Likely open","p_open":1,"p_active":0.664,"p_room":0.75,"age_days":27,"expected_fill_days":32,"reasons":["conf:0","velocity","win:late"],"computed_at":"2026-10-19T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/withsecure-incident-response-investigator","json_url":"https://alion.io/job/withsecure-incident-response-investigator.json","meta":{"generated_at":"2026-10-19T23:24:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2284,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":56688},"rest":"https://alion.io/mcp/rest/get_company?id=56688"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fwithsecure-incident-response-investigator"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fwithsecure-incident-response-investigator"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fwithsecure-incident-response-investigator"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/withsecure-incident-response-investigator\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fwithsecure-incident-response-investigator"}]}