Women in Data®
NMC Cyber Incident Responder (Digital Forensics)
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Expiry date: 23:59, Thu, 24th Sep 2026 Location: Wigan/Hybrid Salary: £55,000 Per Annum Benefits: Competitive benefits
Join Police Digital Service as NMC Cyber Incident Responder (Digital Forensics)
As a member of the National Management Centre (NMC) Cyber Incident Response team, you will lead and support the investigation of cyber security incidents affecting UK policing. This role combines digital forensics, incident response, and stakeholder engagement, requiring the ability to identify, contain, and investigate sophisticated cyber threats across diverse technology estates.
You will conduct forensic examinations of compromised systems, analyse host, network, and memory-based evidence, and support the collection and preservation of digital evidence to establish root cause, impact, and attacker activity. Working closely with threat intelligence, detection engineering, and force stakeholders, you will provide technically sound advice to support incident remediation and organizational decision-making.
Key Responsibilities
Incident Response & Investigation
- Lead and support investigations into cyber security incidents affecting UK policing, including ransomware, malware outbreaks, unauthorized access, data compromise, and insider threat investigations.
- Perform detailed forensic analysis of endpoints, servers, cloud environments, and associated digital evidence to evaluate the scope, root cause, and impact of incidents.
- Support incident containment, eradication, and recovery activities through evidence-based recommendations.
- Develop and maintain investigative methodologies, playbooks, and procedures aligned with recognized incident response frameworks.
Digital Forensics
- Acquire, preserve, and analyze digital evidence in accordance with forensic best practice and evidential integrity requirements.
- Perform forensic collection activities using appropriate live response techniques.
- Analyze operating system artefacts, event logs, registry data, memory captures, network evidence, and application data to support investigations.
- Produce accurate and defensible investigative findings suitable for operational, legal, and executive audiences.
- Maintain awareness of emerging forensic tools, techniques, and methodologies.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Stakeholder Engagement
- Act as a trusted advisor to police forces and policing organizations during cyber incidents.
- Provide clear technical and strategic briefings to senior stakeholders, including Chief Officers, CIOs, Heads of IT, Heads of Cyber Security, and other policing partners.
- Coordinate with internal and external stakeholders to ensure effective incident management and communication throughout the lifecycle of an investigation.
- Support national coordination activities where incidents have cross-force or sector-wide implications.
Threat Analysis & Continuous Improvement
- Utilize threat intelligence, attacker TTPs, and industry frameworks such as MITRE ATT&CK to inform investigations and response activity.
- Identify trends, lessons learned, and opportunities to improve cyber resilience across UK policing.
- Contribute to the development of detection capabilities and response processes through post-incident reviews and technical findings.
- Support knowledge sharing, mentoring, and capability development across the wider NMC function.
What you need to succeed in the role
- Experience conducting digital forensic investigations within enterprise environments.
- Experience performing endpoint and memory forensic analysis during cyber security incidents.
- Experience investigating ransomware, malware, unauthorized access, and data compromise incidents.
- Ability to collect, preserve, and analyze digital evidence while maintaining evidential integrity.
- Strong understanding of Windows internals, operating system artefacts, and attacker tradecraft.
- Experience communicating technical findings and recommendations to senior stakeholders.
- Strong knowledge of incident response lifecycle and cyber investigation methodologies.
- Experience analyzing logs, EDR telemetry, SIEM data, and forensic artefacts to evaluate root cause and impact.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
For a full list of responsibilities and criteria, please refer to the Candidate Pack.
Why Join us?
- Balance is important and we want you to take time off to recharge - we offer 28 days’ annual leave plus bank holidays, rising to 30 days after 5 years of service. Holiday Purchase also available.
- We care about your well-being - we have an EAP that offers not just welfare benefits but also retail discounts.
- Plan for the future - we offer an excellent pension scheme and life assurance cover.
- Put your mind at rest regarding your health - offering remote GP, mental health, and physiotherapy appointments via video consultation.
- Family - Enhanced maternity and paternity pay along with a flexible return to work.
- Community - one paid day off per year for volunteering.
Diversity, equity, and inclusion
We are committed to equal opportunity for all and will not discriminate on any grounds. We encourage applications from people from the widest possible span of experience. We particularly welcome applications from Black, Asian, and Minority Ethnic (BAME) candidates and people with disabilities.
Working Arrangements
At the NMC, you will benefit from hybrid working, getting the advantages of both face-to-face team engagement and home working. NMC employees have the opportunity to work in our modern office environment for in-person collaboration, alongside the opportunity to work from home 2 days a week.
This is a Monday-Friday shift-based role.
All applicants must be eligible for NPPV3 and SC clearances. Successful applicants will require NPPV3 clearance to have been approved before starting with PDS.
Women in Data® advertise roles on behalf of our partners, alliances, and members. We are proud supporters of Women in Data. Connect, engage, and belong to the largest free female data community in the UK – visit: www.womenindata.co.uk to join our community. Stay connected! Follow us on LinkedIn for updates on career opportunities and more.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Location