Principal DFIR Consultant - Remote (Anywhere in the U.S.)
Core
Principal DFIR Consultant leading complex, high-severity cyber incident investigations (ransomware, APT, nation-state) and shaping the DFIR practice.
Role type
Principal individual contributor (technical authority)
Builds
Forensic investigations, threat intelligence, and incident response capabilities for Fortune 500 and government clients
Domain
Cybersecurity / Digital Forensics & Incident Response
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
DFIR investigation, host forensics, network forensics, malware triage, cloud incident response, threat actor attribution, mentoring, methodology development, pre-sales scoping
Preferred skills
Scripting (PowerShell, Python, Bash, Go), EDR/XDR/SIEM expertise, cloud-native forensics, threat intelligence integration, ransomware negotiation, external thought leadership
Technologies
Velociraptor, AWS, Microsoft 365, Azure, Google Workspace, EDR, NDR, XDR, SIEM
Responsibilities
Lead complex high-severity investigations, design DFIR methodologies and playbooks, mentor senior and analyst staff, conduct advanced forensics and malware analysis, support pre-sales and client presentations, develop automation tools
Seniority
Principal, hands-on IC with strategic influence