Requirements

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or related technical field, or equivalent practical experience.
• 5 years of investigative experience including network forensics, malware triage analysis, cloud forensics, or disk and memory forensics.
• 5 years of experience with end-to-end incident response investigations, analysis, or containment actions.
• Ability to travel up to 30% of the time.

Nice to Haves

• Certifications such as GCFA, GCFE, GNFA, GCIA, GREM, GCIH, GX-FA or equivalent, and in cloud platforms.
• Experience participating in security competitions, capture the flags (CTFs), or platforms like Hack the Box, TryHackMe, and Overthewire.
• Strong communication skills to relay investigative findings and strategies to technical staff, executives, legal counsel, and clients.
• Effective time management and mentoring skills to balance multiple tasks and guide junior consultants.

What You'll Be Doing

• Lead large, client-facing incident response engagements and analyze cloud, endpoint, and network evidence.
• Identify attacker tools, tactics, procedures, and indicators of compromise applicable to investigations.
• Create scripts, tools, or methodologies to improve incident investigation processes.
• Develop and present detailed reports, trainings, and presentations for technical and executive audiences.
• Conduct host and network forensics, log analysis, and malware triage during incident response investigations.
• Assist clients in handling complex, high-profile incidents, including forensic analysis, threat hunting, and malware triage.

Perks and Benefits

• Opportunity to work remotely (remote eligible) in the United Kingdom.
• Part of Google Cloud and Mandiant, leaders in cybersecurity, offering exposure to advanced threat intelligence and incident response.
• Engagements with diverse and high-impact cybersecurity incidents and challenges.