Senior Consultant, Cybersecurity (DFIR)

About the role

FTI Consulting's Cybersecurity team supports clients in responding to cyber incidents, investigating security breaches, identifying threat actors and assessing the scope and impact of attacks. Following significant growth, the EMEA Cybersecurity practice is expanding and is looking for a Senior Consultant in Madrid. The role involves leading complex DFIR engagements, mentoring junior team members and contributing to client relationships and service offerings.

Key responsibilities

• Lead and deliver DFIR engagements covering ransomware attacks, data breaches and other complex security incidents.
• Plan and conduct forensic investigations, acquiring and analysing digital evidence across endpoints, servers, networks and mobile devices.
• Identify indicators of compromise, reconstruct attacker activity, determine root causes and assess incident scope and impact.
• Use digital forensic, EDR and SIEM tools to investigate threats and support containment and remediation.
• Prepare and review technical reports, turning complex findings into actionable recommendations for clients and senior stakeholders.
• Manage client relationships, coordinate delivery and ensure quality outputs within agreed deadlines.
• Mentor junior consultants, review their work and help develop the team.
• Support business development, including proposals, service development and improvements to investigative methodologies.
• Stay up to date with emerging threats, forensic techniques and best practices, collaborate with international teams and travel to client sites when required.

Required profile

• Bachelor's degree in Cybersecurity, Computer Science, Digital Forensics or a related field, or equivalent experience.
• Significant experience in DFIR, including leading investigations into ransomware, data breaches and other cyber incidents.
• Proven ability to manage client engagements, produce technical reports, communicate findings and mentor junior team members.
• Excellent written and verbal communication in English and Spanish.
• Ability to work under pressure and travel when required.

Required skills

• Hands-on forensic analysis on Windows, Linux, macOS and/or mobile devices with tools such as FTK Imager, Magnet AXIOM, EnCase, Cellebrite and Volatility.
• Experience with EDR and SIEM tools such as CrowdStrike, SentinelOne, Splunk or Wireshark.
• Understanding of evidence preservation, chain of custody, threat analysis and frameworks such as NIST, ISO 27001 and GDPR.
• Preferred: DFIR certifications (GCFE, GCFA, GCIH, GNFA), scripting in Python, PowerShell or Bash, familiarity with MITRE ATT&CK, and Italian or Portuguese.

What we offer

• Professional development programme, coaching and support for industry certifications.
• Flexible and hybrid working arrangements.
• Wellness, recognition and community volunteering initiatives.
• Market-competitive benefits including pension, plus 15 flexible benefits.