National Enabling Programmes (a programme of the Police Digital Service)
NMC Cyber Incident Responder (Digital Forensics)
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Join Police Digital Service as NMC Cyber Incident Responder (Digital Forensics)
Salary starting at £55,000 per annum
As a member of the National Management Centre (NMC) Cyber Incident Response team, you will lead and support the investigation of cyber security incidents affecting UK policing. This role combines digital forensics, incident response and stakeholder engagement, requiring the ability to identify, contain and investigate sophisticated cyber threats across diverse technology estates.
You will conduct forensic examinations of compromised systems, analyse host, network and memory-based evidence, and support the collection and preservation of digital evidence to establish root cause, impact and attacker activity. Working closely with threat intelligence, detection engineering and force stakeholders, you will provide technically sound advice to support incident remediation and organisational decision-making.
Key Responsibilities
Incident Response & Investigation
- Lead and support investigations into cyber security incidents affecting UK policing, including ransomware, malware outbreaks, unauthorised access, data compromise and insider threat investigations.
- Perform detailed forensic analysis of endpoints, servers, cloud environments and associated digital evidence to evaluate the scope, root cause and impact of incidents.
- Support incident containment, eradication and recovery activities through evidence-based recommendations.
- Develop and maintain investigative methodologies, playbooks and procedures aligned to recognised incident response frameworks.
Digital Forensics
- Acquire, preserve and analyse digital evidence in accordance with forensic best practice and evidential integrity requirements.
- Perform forensic collection activities using appropriate live response techniques.
- Analyse operating system artefacts, event logs, registry data, memory captures, network evidence and application data to support investigations.
- Produce accurate and defensible investigative findings suitable for operational, legal and executive audiences.
- Maintain awareness of emerging forensic tools, techniques and methodologies.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Stakeholder Engagement
- Act as a trusted advisor to police forces and policing organisations during cyber incidents.
- Provide clear technical and strategic briefings to senior stakeholders including Chief Officers, CIOs, Heads of IT, Heads of Cyber Security and other policing partners.
- Coordinate with internal and external stakeholders to ensure effective incident management and communication throughout the lifecycle of an investigation.
- Support national coordination activities where incidents have cross-force or sector-wide implications.
Threat Analysis & Continuous Improvement
- Utilise threat intelligence, attacker TTPs and industry frameworks such as MITRE ATT&CK to inform investigations and response activity.
- Identify trends, lessons learned and opportunities to improve cyber resilience across UK policing.
- Contribute to the development of detection capabilities and response processes through post-incident reviews and technical findings.
- Support knowledge sharing, mentoring and capability development across the wider NMC function.
What You Need To Succeed In The Role
- Experience conducting digital forensic investigations within enterprise environments.
- Experience performing endpoint and memory forensic analysis during cyber security incidents.
- Experience investigating ransomware, malware, unauthorised access, and data compromise incidents.
- Ability to collect, preserve and analyse digital evidence whilst maintaining evidential integrity.
- Strong understanding of Windows internals, operating system artefacts and attacker tradecraft.
- Experience communicating technical findings and recommendations to senior stakeholders.
- Strong knowledge of incident response lifecycle and cyber investigation methodologies.
- Experience analysing logs, EDR telemetry, SIEM data and forensic artefacts to evaluate root cause and impact.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
For a full list of responsibilities and criteria, please refer to the Candidate Pack.
Why Join us?
- Balance is important and we want you to take time off to recharge - we offer 28 days’ annual leave plus bank holidays, rising to 30 days after 5 years of service. Holiday Purchase also available
- We care about your well-being - we have an EAP that offers not just welfare benefits but also retail discounts
- Plan for the future - we offer an excellent pension scheme and life assurance cover
- Put your mind at rest regarding your health - offering remote GP, mental health and physiotherapy appointments via video consultation
- Family - Enhanced maternity and paternity pay along with a flexible return to work
- Community - one paid day off per year for volunteering
You Can Find Out More Here
- Benefits - Police Digital Service (pds.police.uk)
Diversity, equity and inclusion
We are committed to equal opportunity for all and will not discriminate on any grounds. We encourage applications from people from the widest possible span of experience. We particularly welcome applications from Black, Asian and Minority Ethnic (BAME) candidates and people with disabilities.
Working Arrangements
At the NMC, you will benefit from hybrid working, getting the advantages of both face-to-face team engagement and home working. NMC employees have the opportunity to work in our modern office environment for in-person collaboration, alongside the opportunity to work from home 2 days a week.
This is a Monday-Friday shift-based role.
All applicants must be eligible for NPPV3 and SC clearances. Successful applicants will require NPPV3 clearance to have been approved before starting with PDS.
Apply
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London