Senior Cloud Incident Response Consultant (Cyber Security)

Location: London, United Kingdom. The successful candidate must have permission to work in the UK by the start of employment.

Company

hirify.global is a global intelligence and cyber security consultancy helping clients solve complex information security challenges.

What you will do

• Lead technical incident response engagements from first contact through closure as the primary technical resource.
• Lead cloud investigations across AWS, Azure, and GCP, including compromised identities, access keys, APIs, control planes, logs, audit trails, and telemetry.
• Investigate CI/CD pipelines, source code repositories, secrets, software supply chains, Infrastructure-as-Code, automated deployments, containers, and Kubernetes environments.
• Oversee host- and network-based investigations, including triage, containment, recovery, remediation support, evidence collection, forensic analysis, malware analysis, and root cause analysis.
• Investigate cloud compromise, data breaches, ransomware, extortion, Business Email Compromise, and software supply chain incidents.
• Develop and share technical expertise and participate in a 24x7x365 on-call rotation.

Requirements

• 5+ years of experience in technical cloud security, cloud engineering, DevSecOps, platform engineering, or security operations, including hands-on experience with at least one major cloud platform.
• Hands-on experience with AWS, Azure, or GCP, including identity and access management, logging, audit trails, and cloud-native security tooling.
• Experience with CI/CD platforms such as GitHub Actions, GitLab CI, or Azure DevOps, plus Infrastructure-as-Code and automation.
• Strong technical foundations for investigating ransomware, intrusion, and other incident scenarios.
• Comfort using scripting and automation such as Python, PowerShell, or Bash for investigations and analysis.
• Strong investigative mindset, ability to work with limited or incomplete information, and comfort in high-pressure, time-critical client situations.
• Demonstrable knowledge of cyber threat actors and their tactics, techniques, and procedures, particularly those targeting cloud identities, SaaS platforms, and cloud-based infrastructure.
• Ability to communicate technical findings and risk clearly to non-technical client audiences in a professional consulting setting.
• Permission to work in the United Kingdom by the start of employment is required.

Nice to have

• Direct experience in a consulting or in-house incident response team.
• Experience with containers and Kubernetes.
• Cloud and platform certifications, including AWS, Azure, or GCP security and architecture certifications, Kubernetes CKA/CKS, and Terraform.
• Certifications such as GCFE, GCFA, GCLD, GCIH, EnCE, CFSR, CISSP, GREM, OSCP, or Security+.

Culture & Benefits

• Flexible working practices supporting wellbeing and work-life balance during high-pressure incident response work.
• Varied casework for public and corporate clients, with opportunities to broaden into testing and advisory projects.
• 25 days of holiday plus bank holidays, increasing by one day per year of service up to 30 days.
• Pension matching up to 7%, with a maximum combined contribution of 14%, plus financial education.
• Private dental and medical insurance, life insurance at four times annual salary, parental support, virtual GP access, gym discounts, an employee assistance programme, and Headspace access.

Hiring process

• Initial application screening by the recruiting team.
• Interview assessing baseline technical skills, followed by an interview covering previous experience and broader competencies.
• Final interview to determine alignment with the role.