Responsibilities

Duties and Responsibilities

• Respond to client-reported cyber incidents as part of our NCSC CIR Standard Level accredited incident response service, conducting technical investigation activities under the direction of the incident lead.
• Assess risks related to system generated alerts and user reported issues, escalating promptly and in line with established playbooks.
• Action or escalate issues promptly and consistently in line with playbooks.
• Identify areas of improvement for process or technology and contribute to their implementation.
• Conduct forensic acquisition and analysis across a range of platforms and media in both incident response and discrete investigation scenarios, including specialist acquisition and examination of mobile devices.
• Assist with incident management, including scoping work, guiding clients through decision making, and supporting containment and eradication.
• Develop intelligence assessments of incidents and other potential threats to clients.
• Support clients with longer term guidance and support with remediation and security uplift activities.
• Provide specialist advice and guidance to internal teams on technical and forensic matters.
• Support the internal security team in assessing and responding to internal incidents, managing the security queue, and contributing to the continuous improvement of internal security posture.
• Contribute to Projects with both time and expertise.
• Provide a high standard of customer experience to our clients.

Skills/Experience

• Hands-on experience investigating security incidents, whether as a SOC analyst reviewing and analysing alerts and events, or as part of an incident response team conducting technical investigations.
• Ability to conduct technical investigations as part of an incident response team, working under the direction of an incident lead to identify, scope, and document findings clearly.
• Strong working knowledge of Windows endpoint environments and the Microsoft 365 security stack, including Defender for Endpoint, Defender for Identity, and Purview. Experience with Mac and Linux environments or Google Workspace is advantageous but not necessary.
• Experience reviewing, triaging, and analysing security events and alerts, with the ability to distinguish genuine threats from noise and identify indicators of compromise across endpoint, identity, and cloud telemetry.
• Experience extracting and analysing logs from Windows systems, Active Directory, Azure AD, M365 services, and other sources to identify evidence of malicious or anomalous.
• Experience examining Windows hosts for evidence of compromise, including artefact analysis, persistence mechanisms, lateral movement indicators, and timeline reconstruction. Familiarity with Mac and Linux host examination is advantageous but not necessary.
• A proactive mindset: someone who authors and improves playbooks rather than simply following them, and who develops their own approaches to novel or undocumented incident types.
• Proficiency with one or more scripting languages (PowerShell, Python, or similar) to automate triage tasks, parse artefacts, and accelerate investigations.
• Technical curiosity and a genuine interest in the threat landscape, someone who keeps pace with attacker techniques, emerging TTPs, and defensive tooling, and who can learn quickly and often with limited guidance.
• Experience communicating technical findings clearly to clients and stakeholders in high-pressure situations, including the ability to explain complex security events in plain language is desirable.

Please note that this job profile is not an exhaustive list of duties but merely an outline of the key components of the role. You may be required by your line manager to take on additional responsibilities when requested.

About

About Mishcon de Reya Group

The Mishcon de Reya Group is an independent, international professional services business with law at its heart, employing over 1400 people with over 650 lawyers. It includes the law firm Mishcon de Reya LLP and a collection of leading consultancy businesses that complement the firm's legal services.

Mishcon de Reya LLP is based in London, Oxford, Cambridge, Singapore, Hong Kong and UAE. The firm services an international community of clients and provides advice in situations where the constraints of geography often do not apply. The work the firm undertakes is cross-border, multi-jurisdictional and complex, centred around three increasingly entwined and connected sectors: the Innovation Economy, Private Wealth and Capital, and Real Estate. The firm is known as a disputes powerhouse with a formidable capacity firmwide for dispute resolution.

The Mishcon de Reya Group includes consultancy businesses MDR Discover, MDR Mayfair (in London, Singapore and Dubai), MDR ONE, and MDRi (in Hong Kong). The Group also includes MDR Lab, which invests in the most promising early stage legaltech companies as well as the Mishcon Academy, its in-house place of learning and platform for thought leadership.

In 2024, the Group announced its first strategic acquisition in the alternative legal services market, flexible legal resourcing business Flex Legal. It also acquired a majority stake in Somos, a global group actions management business.

We strive to create a fully diverse and inclusive workplace where all our people are empowered to fulfil their potential. We are proud of our agile working culture and are always happy to talk flexible working.