DFIR Consultant

Accountabilities:

• Digital Forensics and Incident Investigations: Conduct hands-on DFIR investigations under the guidance of senior engagement leads, performing host forensics, network traffic analysis, malware handling and triage, log reviews, and Business Email Compromise (BEC) investigations.

• Incident Response Delivery: Support reactive incident response, forensic investigations, proactive threat discovery, threat hunting, and Purple Team exercises in collaboration with offensive security professionals.

• Technical Analysis and Reporting: Analyze forensic evidence, identify suspicious activity, document findings, and produce accurate technical reports outlining investigation results, business impact, and practical remediation recommendations for technical and management audiences.

• Client Engagement and Communication: Support client relationships throughout investigations by communicating technical findings, providing guidance, coordinating activities, and maintaining clear and timely updates.

• Team Collaboration: Work closely with fellow consultants and engagement leads across multiple concurrent engagements, sharing insights and coordinating investigative activities to ensure consistent, high-quality delivery.

• Automation and Process Improvement: Leverage scripting and automation to streamline forensic workflows, reduce repetitive tasks, and improve investigation efficiency.

• Continuous Learning and Development: Stay informed about emerging cyber threats, attacker techniques, investigative methodologies, and industry technologies while continuously developing expertise across core DFIR disciplines.

• Practice Development: Contribute to the evolution of cybersecurity services and investigative capabilities to address emerging threats and changing client requirements.

• Operational Ownership and Availability: Maintain availability outside standard business hours during high-severity incidents, participate in on-call rotations when required, proactively identify delivery or communication gaps, and demonstrate professionalism, initiative, and accountability throughout engagements.

Requirements:

• Education and Experience: High school diploma with at least five years of relevant experience, a bachelor's degree with at least two years of experience, or a master's degree.

• DFIR Technical Expertise: Hands-on experience across core digital forensics and incident response disciplines, including host forensics, network traffic analysis, malware handling and triage, log review, and Business Email Compromise investigations.

• Investigation and Analytical Skills: Ability to investigate complex technical issues, interpret forensic evidence, identify suspicious behavior, and develop effective solutions in rapidly changing environments.

• Communication Skills: Excellent written and verbal communication skills, with the ability to translate complex technical findings into clear, actionable information for both technical and managerial stakeholders.

• Adaptability and Problem-Solving: Strong analytical thinking, creativity, attention to detail, and the ability to adapt to evolving investigative challenges and client priorities.

• Technology Adoption: Demonstrated willingness to embrace emerging technologies, including AI-enabled tools, to improve efficiency, solve problems, and deliver stronger business outcomes.

Preferred qualifications:

• Previous experience in cybersecurity consulting, professional services, or client-facing technical engagements.

• Familiarity with established digital forensics and incident response methodologies and investigative processes.

• Experience with security technologies and platforms such as EDR, NDR, XDR, SIEM, firewalls, NGAV, and Velociraptor.

• Proficiency in scripting and programming languages such as PowerShell, Python, Bash, or Go.

• Experience with enterprise cloud environments, including Amazon Web Services, Google Workspace, Microsoft 365, and Microsoft Azure.

• Understanding of attacker techniques, advanced persistent threat groups, and the application of threat intelligence to incident investigations.

• Relevant industry certifications such as GCFA, GCFE, GCIH, GCIA, GDAT, GREM, or CISSP.

• Travel: Willingness to travel up to 20% depending on client and engagement requirements.

• Working Conditions: Ability to perform primarily sedentary work, including extended computer use, frequent wrist and hand movements, and sustained visual concentration for technical analysis and documentation.

Benefits:

• Primarily remote working environment, available to candidates based in the United States.

• Comprehensive medical insurance options:

  • Zero-deductible PPO plan, with 90% of employee premiums and 70% of family premiums covered by the employer.

  • High-deductible health plan with HSA, with 100% of employee premiums and 75% of family premiums covered by the employer.

  • Annual employer HSA contributions of $850 for individual coverage or $1,750 for family coverage, distributed quarterly.

• Dental insurance, with 100% of employee premiums and 75% of family premiums covered by the employer.

• 12 company holidays annually.

• Flexible Time Off (FTO) program.

• Mobile phone and home internet allowances.

• Eligibility for participation in the retirement plan after two months, subject to enrollment terms.

• Optional pet benefits.

• Professional development opportunities through collaboration with experienced DFIR specialists and cybersecurity professionals.

• Opportunities to work on diverse and challenging cybersecurity investigations across multiple industries.

• Up to 20% travel, providing opportunities for client engagement and professional collaboration.