Senior Cloud Incident Response Consultant

About this role

WHO WE ARE S-RM is a global intelligence and cyber security consultancy. Since 2005, we’ve helped some of the most demanding clients in the world solve some of their toughest information security challenges. We’ve been able to do this because of our outstanding people. We’re committed to developing sharp, curious, driven individuals who want to think critically, solve complex problems, and achieve success. But we also know that work isn’t everything.

It’s about the lives and careers it helps us build. We’re immensely proud of this culture and we invest in our people’s wellbeing, learning, and ideas every day. We’re excited you’re thinking about joining us. WORKING IN CYBER AT S-RM Our Cyber Security division is the fastest-growing part of S-RM. Demand for our Advisory, Ethical Hacking and Incident Response practices has never been higher, and the threat landscape keeps changing.

We are building a team to keep pace, one that responds quickly, innovates and keeps improving. We also don’t believe there is a typical cyber security professional. Our people include intelligence analysts, technical specialists, software developers, investigators and risk managers, so you will always be working alongside different perspectives and expertise that help you learn and grow. If that sounds like your kind of team, we would like to hear from you.

THE ROLE Our Incident Response Consultants are central to the success of our Cyber Security consulting practice. As a Technical Lead, you will bring deep cloud expertise to a senior, client-facing delivery role, leading the response to incidents in cloud environments. You will work across the full lifecycle of security incidents to help clients respond and recover. That includes incidents affecting cloud platforms, identity systems, CI/CD pipelines and software delivery environments, alongside traditional scenarios such as ransomware, business email compromise and intrusion investigations.

Our Incident Response Associates are a critical part of our Cyber Security division’s success. You will lead and deliver technical investigations for clients, including: Leading technical incident response engagements from first contact through to closure Acting as the primary technical resource on response cases, applying your own expertise and guiding colleagues on the project team Leading cloud-based investigations across AWS, Azure and GCP, including: Compromised cloud identities, access keys, APIs and control planes Cloud log, audit trail and telemetry analysis (CloudTrail, Entra ID, Azure Activity Logs, GCP Cloud Audit Logs and similar) Abuse of CI/CD pipelines, source code repositories, secrets and software supply chains Infrastructure-as-Code and automated deployment workflows Containers and Kubernetes environments Overseeing host- and network-based investigations, including triage and containment, system recovery and remediation support, evidence collection and forensic analysis, and malware and root cause analysis Investigating a wide range of incident types, including: Cloud account and tenant compromise Unauthorised access and data breaches in cloud environments Ransomware and extortion incidents Business Email Compromise (BEC) Software supply chain and pipeline compromise Developing and sharing domain expertise.