Impress employers and recruiters.
Choose from hundreds of resume examples.

Target Resume Now

Tailor your resume to this Cyber Incident Response Consultant role.

Rezi rewrites your resume against Control Risks's job description. Free.

Resume score gauge reading 58 out of 100

Don't guess if your resume is good enough.

See how it scores against the Cyber Incident Response Consultant posting at Control Risks — free, in seconds.

About the Role

As the Cyber Incident Response Consultant, you will be responsible for delivering Control Risks' Cyber Incident Response projects for clients. You will work on high-profile incidents, conduct compromise assessments and business email compromise investigations, and investigate and help lead the technical response to complex cases, including ransomware attacks. The role also contributes to developing the investigative toolsets and automation used by the practice.

Responsibilities

Lead and assist with host, network, web server and cloud-based investigations into complex cyber incidents, including ransomware attacks.
Investigate incidents affecting SaaS platforms and software development environments (e.g. source code repositories and CI/CD pipelines), drawing on an understanding of common development practices.
Perform threat hunting and identification of attacker activity using EDR and agent-led forensic tooling.
Conduct live compromise assessments for organizations suspecting live and ongoing system intrusion.
Detect and hunt unknown live, dormant, and custom malware in memory across multiple systems in an enterprise environment.
Contribute to the design and development of investigative toolsets and automation.
Assist with commercializing developed technology to ensure it is fit for purpose.
Demonstrate an understanding of both existing and emerging threat actors, and experience identifying rapidly changing tools, tactics and procedures of attackers.
Work with the Cyber Threat Intelligence team to identify where technical information acquired during Cyber Response cases can benefit them.
Identify and implement where threat intelligence can be leveraged through tooling and automation.
Advise on the safe technical recovery of an organization's IT systems, balancing the need to understand what has happened with the speed of recovery.
Ensure tooling and automation developed is customer friendly to deploy and use.
Be responsible for customer queries arising from the use of technology and automation.
Provide situation reports and other significant case-related material to the client, case lead, and team leadership.
Provide documentation to relevant consultants for review and feedback before client submission.
Contribute to high-quality client reports highlighting technical findings in a structured and defensible manner.
Discuss and input into Control Risks’ cyber response methodologies and approaches, tailoring the approach in changing market conditions.
Join the team’s on-call duty rota.
Identify potential new areas of growth and opportunity.

Requirements

Proven experience investigating complex cyber incidents, including ransomware attacks, as part of an incident response team.
Technical degree or demonstrated knowledge of common networks, software and hardware used in business environments.
Strong understanding of enterprise infrastructure, web servers and cloud environments (e.g. Microsoft Azure / Entra ID, AWS, Google Cloud), including how they are attacked and investigated.
Experience in conducting log analysis and digital forensics following a cyber incident.
Proven experience in responding to cyber-attacks.
Fluent in English (written and spoken).
Excellent presentation skills.
Excellent analytical skills.
Scripting and/or development experience.
Demonstrable investigative mindset and independent research of complex incidents.
Interest in developing investigative toolsets and automation to support and enhance our cyber incident response practice.
Strong understanding of MITRE ATT&CK techniques / sub-techniques.
Ability to articulate TTPs to clients in non-technical terms.
Experience in generating SIGMA rules for host detection, SNORT rules for network detection and YARA Signatures for file and memory artefact identification.
General understanding of common SaaS platforms and software development practices (e.g. source control, CI/CD pipelines, APIs), sufficient to investigate incidents affecting these environments.

Skills

Cyber Incident Response
Compromise Assessments
Business Email Compromise Investigations
Ransomware Attacks
Infrastructure
Web Servers
Cloud Environments
Threat Actors
Tooling Development
Automation
Host Investigations
Network Investigations
Cloud-based Investigations
SaaS Platforms
Software Development Environments
Source Code Repositories
CI/CD Pipelines
Threat Hunting
EDR
Forensic Tooling
Live Compromise Assessments
Malware Detection
Memory Analysis
Enterprise Environment
Threat Intelligence
Log Analysis
Digital Forensics
MITRE ATT&CK
SIGMA Rules
SNORT Rules
YARA Signatures
APIs

Location

London, UK

Work Type

Hybrid

Experience Level

Proven experience

Education Level

Technical degree or demonstrated knowledge

Benefits

Competitively positioned compensation and benefits package
Discretionary global bonus scheme

About the Company

Control Risks is a global leader in political risk, comprehensive security risk management and threat analysis.

Equal Opportunity

As an equal opportunities employer, we encourage suitably qualified applicants from a wide range of backgrounds to apply and join us and are fully committed to equal treatment, free from discrimination, of all candidates throughout our recruitment process.
If you require any reasonable adjustments to be made in order to participate fully in the interview process, please let us know and we will be happy to accommodate your needs.