Incident Responder

Incident Responders handle live security incidents: ransomware, data breach, BEC, insider threat, nation-state intrusions. Work splits between consultancy IR (Mandiant, Kroll, NCC, KPMG, Secureworks) and in-house IR (banks, insurers, scale-ups). ## Career milestones ### Year 0 — Junior IR Analyst (often Tier 2/3 SOC route) _Salary: £45k–£60k_ Triage incidents, collect forensic artefacts, write timelines, support seniors on live engagements. ### Year 1–3 — Incident Responder _Salary: £60k–£85k_ Lead small-mid incidents, own the IR lifecycle, host artefacts (EnCase, Velociraptor, KAPE). ### Year 3–5 — Senior Incident Responder _Salary: £85k–£115k_ Lead enterprise ransomware engagements, brief CIO/CISO, manage on-call rotation. ### Year 5+ — Principal IR / IR Lead / Practice Lead _Salary: £115k–£170k+_ Own IR practice, client comms during crisis, regulator engagement, post-incident reviews. ## Core skills - NIST 800-61r2 IR lifecycle - Host forensics (Windows, macOS, Linux) — KAPE, Velociraptor, Volatility - Memory analysis (Volatility 3, Rekall) - Cloud IR (AWS / Azure / GCP — CloudTrail, Unified Audit Log, GCP Audit Logs) - Ransomware playbooks (containment, recovery, negotiation awareness) - Log analysis at scale (Splunk, Sentinel, Elastic) - Threat intelligence integration - Crisis communication and exec briefing ## Recommended certifications - `security-plus` - `azure-security` - `cissp` ## First 90 days in the role Shadow 3+ live engagements. Read every post-incident report from the last 24 months — pattern-match the recurring failure modes. Build your personal triage script library (KAPE targets, Velociraptor hunts, custom PowerShell). ## Common pitfalls Tool obsession. The best responders win on disciplined methodology and clear communication under pressure, not on tool collection. Practise writing a 1-page exec brief at 3am.