Principal DFIR Consultant

Job Summary

To support a growing incident response practice, the full-time Principal DFIR Consultant will lead investigations into threat activity across traditional and cloud-native environments, utilizing AI-driven tools to enhance forensic analysis while working remotely.

Key responsibilities:

• Lead and manage incident response cases involving ransomware and nation-state threats across multi-cloud environments
• Utilize AI-assisted tooling to enhance investigation processes and develop an LLM-based investigative platform
• Conduct thorough investigations into suspicious activities, leveraging knowledge of forensic artifacts and cloud-native log sources

Required qualifications:

• Experience as an IR consultant or SOC analyst responding to threat activity
• Strong understanding of Windows, Mac, and Linux fundamentals, forensic artifacts, and network analysis
• Knowledge or eagerness to learn about cloud-native investigations, including AWS, GCP, and Azure
• Interest in leveraging LLMs and AI tools to improve investigation efficiency while maintaining forensic rigor
• Commitment to high-quality investigative standards in all casework