DFIR Expert
Core
Senior hands-on DFIR responder executing containment, eradication, and recovery on major incidents while conducting end-to-end forensic investigations across cloud, platform, and endpoint environments.
Role type
Senior hands-on DFIR Expert
Builds
Forensic evidence, technical reports, root cause analyses (RCA), and regulatory-ready documentation
Domain
Cybersecurity, Digital Forensics, Incident Response, Cloud Security
Required skills
Disk and memory forensics, Cloud and container forensics, Malware triage, EDR/SIEM/forensic tooling usage, Scripting (Python, PowerShell, SQL/KQL), MITRE ATT&CK fluency, Chain-of-custody discipline
Preferred skills
GCFE, GCFA, GNFA, GCFR, or GREM certifications
Technologies
Velociraptor, Volatility, X-Ways, EnCase, Kubernetes, Cloud control planes
Responsibilities
Execute technical response to major incidents from escalation through recovery, Conduct end-to-end forensic investigations across cloud, platform, and endpoint environments, Handle evidence meeting legal and forensic standards, Produce post-incident deliverables including technical reports and RCAs, Contribute to DFIR runbooks and readiness exercises, Mentor SOC analysts and participate in on-call rotation
Seniority
Senior, hands-on IC