Incident Response Lead (DFIR)

# Incident Response Lead (DFIR) LT Harper Recruitment Group England Hybrid Lead/Principal Full-time £90,000.00/yr - £110,000.00/yr The RoleThis hands-on leadership position sits within a cyber consultancy's incident response practice. Day to day, the postholder manages a portfolio of live incidents end to end - scoping, triage, containment, evidence preservation and recovery - while personally conducting and quality-assuring digital forensics across disk, memory, network traffic and log data. On-call rotation and occasional short-notice travel are required. Skills & ExperienceCandidates need significant experience managing complex cyber incidents and strong forensic competency with tools such as X-Ways, EnCase, FTK, AXIOM or Cellebrite. Technical depth in network/log analysis, memory forensics, malware reverse engineering or mobile forensics is essential. Python scripting and certifications such as GCFA, GCIH, GNFA or CCIM are highly desirable, as is current SC or DV clearance. Who It SuitsThe role suits a seasoned DFIR professional ready to step into operational leadership without leaving technical work behind. It offers a clear path to service line leadership, exposure to high-profile government and critical national infrastructure incidents, funded certifications, and a structured progression framework within a growing practice.Typical advertised salary forIncident Response roles in United Kingdom: £53,000-£90,000 (median £70,000 - from30 recent listings analysed by Forensic Focus).Compare Incident Response salaries in United Kingdom Certifications mentioned:GCFA GNFA GCIH - find training for these on theDFIR Training Finder.Learn More/Apply