Incident Responder

Due to continued growth, Bridewell's CSIRT is looking for a Senior Incident Responder to support our CNI and other clients. This role will investigate and respond to security incidents, contribute to incident preparation and recovery activities, and help clients strengthen their security posture. 

This role focuses on supporting and maintaining incident response capabilities across endpoint, network, and cloud environments for both our SOC services and consulting engagements. The Senior Incident Responder will work with colleagues and clients to deliver effective investigations, improve response processes, and develop their technical expertise. 

Requirements

Main Responsibilities:

• Support the delivery and ongoing improvement of incident response services, including maintaining technical documentation, playbooks, and response procedures for endpoint, network, and cloud environments.
• Follow established triage, investigation, and escalation processes when responding to alerts and security incidents across modern hybrid IT environments.
• Investigate security incidents across endpoint, network, and cloud platforms, working with senior responders to identify appropriate containment, remediation, and recovery actions.
• Carry out investigation, containment, and eradication activities for security incidents, escalating complex or high-priority matters when required.
• Support the forensic acquisition, preservation, examination, and analysis of digital evidence from endpoints and other relevant systems, maintaining appropriate evidential handling and investigation records.
• Undertake logical acquisition and forensic analysis of supported mobile devices, including Android, iOS, iPadOS, and Windows devices, using approved tooling and documented processes. Device access may require a valid passcode.
• Work collaboratively with other incident responders and SOC analysts to ensure consistent, high-quality delivery across client environments.
• Support customers in improving their detection and response capabilities across their IT estate.
• Contribute to the development and maintenance of incident response plans and playbooks in line with industry standards and good practice.
• Support and conduct threat hunts across endpoint, network, and cloud environments.
• Perform initial malware analysis and support more detailed analysis where required during incident response activities.
• Contribute to internal knowledge sharing and, where appropriate, technical blogs, webinars, or other industry content.
• Support incident coordination during active incidents, providing clear updates and maintaining accurate investigation records.