[Hiring] Principal Security Consultant @Zenzero Solutions

Role Description

As a Principal Security Consultant, you will lead high-impact digital forensics and incident response (DFIR) engagements for clients facing some of today's most challenging cyber threats, including:

• Ransomware
• Business email compromise (BEC)
• ClickFix attacks

Acting as the senior technical lead throughout the incident lifecycle, you will guide investigations from:

• Initial triage
• Containment
• Forensic analysis
• Recovery
• Final reporting

Working within the DFIR Forensics team, you will collaborate with:

• Incident managers
• SOC specialists
• Account teams
• Insurers
• Legal partners
• Client leadership

This is an opportunity to:

• Shape investigation methodology
• Strengthen tooling
• Mentor consultants
• Influence the development of a growing cyber security practice

Success in this role means:

• Delivering exceptional client outcomes
• Providing trusted technical leadership during live incidents
• Developing team capability
• Continuously improving forensic processes and services

Qualifications

• Proven ability to lead complex DFIR investigations and manage client-facing incident response engagements
• Deep understanding of ransomware intrusion lifecycles and adversary tradecraft
• Strong expertise in Microsoft 365 and BEC investigations, including audit log analysis and identity compromise scenarios
• Advanced knowledge of Windows host forensics, evidence collection, event log analysis, and memory analysis techniques
• Experience presenting technical findings and recommendations to senior stakeholders
• Strong communication, judgement, and decision-making skills under pressure
• Degree-level education in a relevant discipline or equivalent practical experience

Requirements

• Experience supporting insurer-led or legally privileged investigations
• Experience within an NCSC CIR Enhanced organisation
• Knowledge of Google Workspace investigations
• Industry certifications such as GCFA, GCFE, GCIH, GNFA, GREM, CREST CCIM, or CRIA