Manager, Digital Forensics & Incident Response (DFIR)

Are you a Cyber Security professional with experience in Digital Forensic and Incident response? Are you looking for tremendous exposure to a wide range of different cases and technologies, to be recognised for your accomplishments, while making a real impact? If yes, we would love to hear from you!

Aon are recruiting for a Manager – DFIR to join our team. This is a hybrid role, meaning the flexibility to work from home and in our London office.

If this sounds like you, but perhaps the commute is too far- please still get in touch!

Aon is in the business of better decisions

At Aon, we shape decisions for the better to protect and enrich the lives of people around the world.

As an organisation, we are united through trust as one inclusive, diverse team, and we are passionate about helping our colleagues and clients succeed.

What the day will look like

As Manager, you are expected to bring extensive experience in the cybersecurity industry to bear on your casework. You will work at the direction of a Director or Managing Director in the unit to scope, coordinate, and provide peerless service on client cases-- which might require analysis of any technology used today: mobile devices, laptops and workstations, servers, networking switches, IoT devices, or cloud-based accounts and infrastructure. You will be expected to perform daily tasks associated with cyber breach response and investigations. As Manager, you are responsible for augmenting and strengthening your personal DFIR skill set, as well as helping develop the skills of the entire DFIR team.

Support the most complex forensic analyses handled by the firm. Investigate network intrusions and other cybersecurity incidents to determine the cause and extent of the breach. Includes ability to perform host-based and network-based analysis across all major operating systems and network device platforms. Preserve, harvest and analyse data from electronic data sources, including laptop and desktop computers, servers, and mobile devices. Produce high-quality oral and written work product, presenting complex technical matters clearly and concisely. Form and articulate expert opinions based on analysis. Possess the experience, credibility, and integrity to perform as an expert witness. Consult with and take direction from supervisors, engagement managers, and clients regarding case investigation and status. Support the mentorship and technical development of junior Digital Forensics staff. Investigate instances of malicious code and documents to determine attack vectors and payloads. Develop and refine policies and procedures for forensic and malware analyses. Research, develop, and recommend hardware and software needed for incident response and help develop and maintain policies and procedures to analyse digital evidence. Participate in technical meetings and working groups to address issues related to cybersecurity and incident preparedness and ability to create targeted remediation plans for clients who have been compromised.

How this opportunity is different

We are the only team in the market that has the scope and breadth of services to offer clients in any area of the cyber life cycle. If you want to work on some of the highest profile and complex cases out there, we are that first responder. With teams in our state of the art DFIR labs, as well as virtual, your work will vary from day to day responding to breaches, nation state attacks, ransomware, just to name a few. The team works closely together to ensure learning, growth and career development. And we invest in you, in the form of mentorship and training budgets to attend security training and conferences.

Skills and experience that will lead to success

Digital forensics / incident response certification(s) such as SANS certifications (GCFA, GCIH etc), CREST certifications (CPIA, CRIA etc.), or equivalent. Deep experience with most common operating systems (Windows, macOS, Linux, iOS, Android) and their file systems (ext3/4, HFS+, APFS, NTFS, exFAT, etc.). Proficiency with industry-standard DFIR toolsets, such as X-Ways, EnCase, Axiom, Cellebrite, FTK and Volatility. Proficiency with database querying and analysis. Experience with cloud infrastructures for the enterprise, such as Amazon Web Services, G Suite, Office 365, and Azure. Experience with conducting log analysis of large datasets. Experience with command line tools (grep, sed, awk, python, and other programming languages. Familiarity with computer system hardware and software installation and troubleshooting. Well-developed analytic, qualitative, and quantitative reasoning skills and demonstrated creative problem-solving abilities. Proficiency with MS Office Applications, and familiarity with Windows, Macintosh and Linux operating systems.

Preferred Experience

Strong work ethic and motivation, with a demonstrated history of ability to lead a team and develop talent. Even stronger analytic, quantitative, and creative problem-solving abilities. Interest in building intellectual capital for the firm by writing blogs and creating internal tools for analysis. Ability to anticipate and respond to changing priorities and operate effectively in a dynamic, demand-based environment, requiring flexibility and responsiveness to client matters and needs. Strong verbal and written communication skills. Must be able to work collaboratively across departments and physical locations. Participation in technical meetings and working groups to address issues related to malware security, vulnerabilities, and issues of cybersecurity and preparedness. A high level of professionalism in all areas of performance. A constantly developed DFIR skill set, and proficiency with industry standard tools and practices, through outside training and research. Comfort with intermittent periods of travel, evening and weekend hours.

How we support our colleagues

In addition to our comprehensive benefits package, we encourage a diverse workforce. Plus, our agile, inclusive environment allows you to manage your wellbeing and work/life balance, ensuring you can be your best self at Aon. Furthermore, all colleagues enjoy two “Global Wellbeing Days” each year, encouraging you to take time to focus on yourself. We offer a variety of working style solutions, but we also recognise that flexibility goes beyond just the place of work... and we are all for it. We call this Smart Working!