Cybersecurity Consultant

About the role

FTI Consulting's Cybersecurity team supports clients in responding to cyber incidents, investigating security breaches, identifying threat actors and assessing the scope and impact of attacks. It combines technical expertise in Digital Forensics and Incident Response (DFIR) with clear communication of findings. Following recent growth, the EMEA Cybersecurity practice is expanding and is looking for a Consultant to join the Madrid team.

Key responsibilities

• Support and execute cybersecurity engagements covering incident response, digital forensics and cyber investigations.
• Investigate security incidents such as ransomware, data breaches, unauthorized access and suspected data exfiltration.
• Acquire, preserve and analyze digital evidence from endpoints, servers, mobile devices and other systems.
• Analyze artifacts on Windows, Linux, macOS and mobile devices to find indicators of compromise, reconstruct attacker activity and build incident timelines.
• Use EDR, SIEM and forensic tools to investigate suspicious activity and support containment and remediation.
• Maintain evidence-handling procedures, including chain of custody, and write clear technical reports.
• Contribute to client presentations and help develop assessment approaches and incident response procedures.
• Stay current on threats and best practices, collaborate across the global Cybersecurity practice, and travel to client sites when required.

Required profile

• Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics or a related field, or equivalent practical experience.
• Professional experience in DFIR, cybersecurity incident response or digital investigations.
• Experience with forensic images and artifacts from Windows, Linux, macOS and/or mobile devices.
• Excellent written and verbal communication in English and Spanish; willingness to travel.

Required skills

• Forensic tools: FTK Imager, EnCase, Magnet AXIOM, Cellebrite, Volatility.
• Telemetry analysis: Wireshark, Splunk, ELK or similar.
• EDR familiarity: SentinelOne, CrowdStrike, Carbon Black.
• Preferred: GCFE, GCFA, GCIH, GNFA certifications; memory forensics, malware triage, threat hunting, MITRE ATT&CK knowledge; scripting in Python, PowerShell or Bash.

What we offer

• Hands-on experience across engagements, coaching and mentoring, and support for professional certifications.
• Flexible benefits including pension, health and family-friendly options.
• Wellness, recognition, volunteering initiatives and flexible/hybrid working arrangements.