Principal Consultant, Cloud DFIR (Unit 42) - Remote
Core
Leading cloud-focused incident response and digital forensics investigations across AWS, Azure, GCP, and hybrid environments to investigate security breaches, contain threats, and guide recovery efforts.
Role type
Senior individual contributor Principal Consultant (Cloud DFIR)
Builds
Actionable remediation recommendations, executive-ready reports, and cloud investigation methodologies/playbooks
Domain
Cybersecurity / Cloud Infrastructure
Deliverable
client delivery
Required skills
Cloud forensic analysis, incident response leadership, cloud telemetry analysis (audit logs, IAM, network traffic), threat investigation (ransomware, data theft), cloud architecture understanding, client-facing consulting
Preferred skills
Enterprise-scale incident response, cloud security platforms (Security Hub, GuardDuty, Defender, Sentinel), container/Kubernetes investigation, MITRE ATT&CK knowledge, professional services experience
Technologies
AWS CloudTrail, Azure Activity Logs, Microsoft Entra ID, Google Cloud Audit Logs, AWS, Azure, GCP, Kubernetes
Responsibilities
Lead cloud-focused incident response and digital forensics engagements; Investigate attacks involving cloud infrastructure, identity compromise, ransomware, and data theft; Analyze cloud telemetry including audit logs, IAM activity, and network traffic; Conduct forensic acquisition and analysis across cloud and hybrid environments; Serve as technical lead guiding strategy and client communications; Support development of cloud investigation methodologies and tooling; Mentor team members and contribute to knowledge sharing
Seniority
Principal, senior hands-on IC