Senior Consultant, Incident Response and Threat Hunting

Role Summary The Senior Consultant, Incident Response & Threat Hunting leads complex cybersecurity investigations, digital forensic engagements, threat hunting operations, compromise assessments, cloud incident response activities, and AI-related security investigations. The role combines deep technical expertise with consulting, stakeholder management, and leadership capabilities to deliver high-value client engagements across enterprise, cloud, mobile, and hybrid environments. The consultant will also mentor junior staff, develop service offerings, and contribute to cyber resilience initiatives. Key Responsibilities Incident Response - Lead end-to-end incident response engagements involving: - Ransomware attacks - Advanced persistent threats (APT) - Business email compromise (BEC) - Cloud compromises - Insider threats - Data exfiltration incidents - Identity-based attacks - Establish investigative strategies and response priorities. - Direct forensic acquisition, evidence preservation, root cause analysis, and attack reconstruction. - Develop containment, eradication, recovery, and remediation recommendations. - Lead executive briefings and incident response war rooms. Threat Hunting - Lead proactive threat hunting engagements across enterprise and cloud environments. - Develop intelligence-driven and hypothesis-based hunting methodologies. - Conduct advanced threat hunts against sophisticated adversaries and emerging attack techniques. - Correlate endpoint, network, cloud, identity, mobile, and application telemetry. - Identify detection gaps and improve monitoring capabilities. - Develop threat hunting playbooks, detection use cases, and adversary emulation scenarios. - Mentor consultants on advanced hunting methodologies and threat intelligence utilisation. Digital Forensics - Conduct forensic investigations across: - Windows - Linux - Unix - macOS - Virtualized environments - Perform attack reconstruction and evidentiary analysis. - Lead malware triage and forensic examinations. - Produce defensible investigative findings and reports. Network & Security Appliance Investigations - Lead investigations involving: - Firewalls - VPN solutions - NetScaler - F5 Load Balancers - WAF platforms - IDS/IPS solutions - Email gateways - Proxy solutions - NDR platforms - Endpoint security solutions - Analyse network traffic, authentication patterns, lateral movement, and data exfiltration activities. - Review security architecture and identify attack paths. Cloud & Identity Response - Lead compromise assessments and incident response engagements involving: - Microsoft Azure - AWS - GCP - Microsoft 365 - SaaS platforms - Investigate identity-based attacks involving Active Directory and Microsoft Entra ID. - Analyse cloud-native logs, security telemetry, and access activities. Mobile Security Investigations - Lead investigations involving Android and iOS devices. - Conduct mobile compromise assessments and forensic analysis. - Review mobile application threats, MDM events, and enterprise mobility incidents. AI Security Investigations - Lead investigations involving: - AI platforms - LLM deployments - Generative AI applications - AI agents - AI-enabled business systems - Assess: - Prompt injection attacks - AI misuse - Unauthorized model access - Model poisoning - Data leakage - AI supply chain risks - Advise clients on AI security controls, governance, and incident response preparedness. Incident Replay & Cyber Range Capability - Design, build, and manage virtualized forensic laboratories and cyber range environments. - Reconstruct incidents through attack replay and adversary emulation. - Develop isolated environments for malware detonation and investigation. - Simulate enterprise infrastructures to validate attack paths and investigative findings. - Develop repeatable environments for incident readiness testing and tabletop exercises. - Automate investigation workflows and analysis processes where appropriate. Client Advisory & Consulting - Lead client workshops, tabletop exercises, breach simulations, and cyber readiness assessments. - Present findings to executives, legal counsel, regulators, and technical stakeholders. - Develop incident response playbooks, forensic methodologies, and response procedures. - Mentor junior consultants and contribute to team capability development. Business Development & Thought Leadership - Support proposal development and pre-sales activities. - Contribute to research, publications, threat intelligence initiatives, and service innovation. - Develop new service offerings related to DFIR, threat hunting, cloud security, and AI security. Requirements - Bachelor's Degree in Cybersecurity, Information Security, Computer Science, Information Technology, or related field. - Equivalent practical experience may be considered. - 5-10+ years of experience in Incident Response, Digital Forensics, Threat Hunting, Cyber Security Consulting, Security Operations Technical Expertise Systems & Endpoint Security - Windows, Linux, Unix, macOS. - Endpoint forensic investigations. - Malware analysis and attack reconstruction. - Active Directory and Entra ID investigations. Network & Security Infrastructure - TCP/IP and enterprise networking. - Network forensics and packet analysis. - Firewall technologies. - VPN platforms. - IDS/IPS. - Proxy solutions. - NDR platforms. - Security appliance investigations. Cloud & Identity - Azure - AWS - GCP - Microsoft 365 - SaaS security - Cloud-native logging and investigations Threat Hunting & Detection Engineering - MITRE ATT&CK - Threat intelligence - Detection engineering - SIEM, EDR, NDR, and SOAR platforms - Adversary emulation and attack simulation Mobile Security - Android and iOS investigations - Mobile device forensics - Mobile threat analysis - MDM solutions AI Security - AI/LLM security architecture - AI threat models - AI incident response methodologies - AI governance and risk Virtualization & Incident Replay - VMware ESXi - Hyper-V - Proxmox - KVM - Cloud-based lab environments - Cyber range design and administration - Sandbox technologies - Attack replay and adversary emulation Scripting & Automation - PowerShell - Python - Bash - Automation and orchestration tools Preferred Certifications - GCFA; GCIH; GNFA; GCFE; GCIA; CISSP; CCSP; SC-200; SC-100; AZ-500; AWS Security Specialty; CCD; Mobile forensic certifications; AI security or governance certifications Core Competencies - Incident Response - Threat Hunting - Digital Forensics - Network Security - Cloud Security - Mobile Security - AI Security - Security Appliance Investigation - Attack Reconstruction - Incident Replay & Cyber Range Operations - Technical Reporting