Cybersecurity Consultant

About the role

FTI Consulting's Cybersecurity team supports clients in responding to cyber incidents, investigating security breaches, identifying threat actors and assessing the scope and impact of attacks. It combines technical expertise in Digital Forensics and Incident Response (DFIR) with clear communication of findings. The firm is expanding its EMEA Cybersecurity practice and is looking for a Consultant to join the Madrid team.

Key responsibilities

• Support and execute cybersecurity engagements covering incident response, digital forensics and cyber investigations.
• Investigate security incidents such as ransomware, data breaches, unauthorized access and suspected data exfiltration.
• Acquire, preserve and analyze digital evidence from endpoints, servers, mobile devices and other systems.
• Analyze artifacts on Windows, Linux, macOS and mobile devices to find indicators of compromise, reconstruct attacker activity and build incident timelines.
• Use EDR, SIEM and forensic tools to investigate suspicious activity and support containment and remediation.
• Maintain evidence-handling procedures, including chain of custody, and prepare clear technical reports.
• Contribute to client presentations and communicate findings to technical and non-technical stakeholders.
• Help develop assessment approaches, investigative methods and incident response procedures, and stay current on threats and best practices.
• Collaborate with colleagues across the global Cybersecurity practice and other service lines, and travel to client sites and offices when required.

Required profile

• Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics or a related field, or equivalent practical experience.
• Professional experience in DFIR, cybersecurity incident response or digital investigations.
• Hands-on experience investigating incidents and analyzing indicators of compromise.
• Experience acquiring, preserving and analyzing forensic images and artifacts from Windows, Linux, macOS and/or mobile devices.
• Excellent written and verbal communication in English and Spanish; willingness to travel.

Required skills

• Familiarity with tools such as FTK Imager, EnCase, Magnet AXIOM, Cellebrite, Volatility, Wireshark, Splunk, ELK, SentinelOne, CrowdStrike and Carbon Black.
• Knowledge of evidence preservation, chain of custody and frameworks such as NIST, ISO 27001 and GDPR.
• Preferred: certifications such as GCFE, GCFA, GCIH or GNFA; experience with ransomware, BEC, insider threats and memory/disk forensics; scripting in Python, PowerShell or Bash; knowledge of MITRE ATT&CK.

What we offer

• Professional development, coaching and mentoring, and support for professional certifications.
• Market-competitive benefits, including pension.