TryHackMe seeks defensive security professionals to join its content team; open to permanent hires as well as short-term and longer-term contract options.
Research, design, and develop defensive cyber security training material with supporting hands-on lab exercises.
Draw on your real world IR experience to build realistic, scenario driven labs that reflect how attacks actually unfold in enterprise Windows environments.
Develop and configure virtual machines and sample datasets for realistic cybersecurity labs.
Collaborate closely with your team by sharing expertise, reviewing each other's work, and raising the quality bar collectively.
Take charge of planning and designing portions of the content development roadmap.
Collaborate with the Head of Content Engineering to continuously improve the content development process.
Analyse industry trends in tooling and techniques and recreate them as teachable content.
Strategically plan, review, and schedule content with our blue team content engineering team.

Significant hands on relevant cyber security industry experience in roles such as Incident Responder, Threat Hunter, Digital Forensics Investigator or L3 SOC Analyst.
Proven, hands-on experience responding to real incidents in Windows environments.
Solid grounding in Windows forensics and artefact analysis - event logs, registry hives, NTFS artefacts, and memory/disk forensics.
Working knowledge of offensive techniques used against Windows and Active Directory environments.
Hands-on familiarity with attacker tooling and tradecraft - fileless execution, living-off-the-land techniques.
Experience with DFIR collection tooling such as EZ Toolset, Velociraptor, KAPE, or equivalent.
Strong verbal and written English communication skills.
Preferred: Any experience creating training content, writing documentation, or explaining technical concepts.
Preferred: Deeper expertise in one or more specialist areas (Active Directory attacks, memory forensics, advanced NTFS analysis).
Preferred: Creating challenges for capture the flags (CTFs).
Preferred: Experience leading, coaching, or mentoring others.
Preferred: Certifications such as GCIH, GCED, SAL2, GCFA.
At this time, we are unable to provide sponsorship. At least 4 hours of overlap with the UK timezone (from 8am - 6pm).

Done for you

We'll apply to this for you

Denidel's HR team submits and tracks the application on your behalf.

Opens the employer's own site, where you complete your application

Posted	07 Oct 2026
Views	1

Senior Windows IR Practitioner - Cyber Security Training