About the assignment
You join a high-impact DFIR function where you investigate sophisticated cyber incidents, lead response operations, and drive forensic excellence. You work on cases spanning endpoint compromise, data exfiltration, ransomware, and advanced persistent threats. Your expertise shapes incident response strategy, tooling, and team capability—making you a trusted advisor to senior leadership during critical events.
This is a hands-on consulting role: you own investigations end-to-end, mentor junior analysts, and collaborate with threat intelligence, SOC, and legal teams. You balance active case work with building scalable processes and training programmes.
Your responsibilities
- Lead end-to-end digital forensics investigations on Windows, Linux, and macOS systems
- Conduct memory analysis, disk imaging, timeline reconstruction, and artefact interpretation
- Coordinate incident response activities and communicate findings to stakeholders and legal teams
- Design and improve DFIR processes, playbooks, and tooling to scale team capability
- Mentor junior analysts and conduct training on forensic techniques and tools
- Document evidence chains and prepare findings for regulatory and law enforcement handovers
- Stay current with emerging threats, adversary tactics, and forensic evasion techniques
Tech Stack & Tools
Platforms & Tooling
Frameworks & Standards
Cloud & Infrastructure
Methodologies
Certifications (preferred)
Must-haves
- 8+ years in digital forensics, incident response, or threat hunting
- Deep hands-on experience with Windows and Linux forensic analysis
- Proficiency with industry-standard forensic tools (EnCase, FTK, Volatility, or equivalent)
- Track record leading complex investigations and delivering findings under pressure
- Strong communication skills; able to explain technical findings to non-technical stakeholders
Nice-to-haves
- Experience with cloud forensics (AWS, Azure, GCP)
- Malware analysis and reverse engineering background
- Expertise in adversary TTPs and threat intelligence integration
- GCIH, GCIA, or GCFE certification
What we offer
- Work on high-stakes investigations with strategic impact
- Lead and mentor a growing forensics team
- Access to cutting-edge forensic tools and lab environments
- Continuous learning through emerging threats and techniques
- Flexible hybrid working and strong work-life balance
- Personal guidance from a dedicated MVPeople consultant who knows your niche
The process
Introduction
Phone call with your MVPeople consultant (within 24 hours)
Match & Brief
We discuss the assignment in detail and prepare you
Client meeting
Introduction to the client
Start
Contracting and onboarding
Details
Type
Permanent (MVPermanent)
Location
Utrecht
Work model
Hybrid
Level
Lead
Industry
overige
Market indication
€95,000 - €125,000 per year
Posted
4 November 2026
Job ID
59743
Contact
MVPeople Group
cv@mvpeoplegroup.com