DFIR Consultant

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a DFIR Consultant based in the United States.

We are seeking a skilled Digital Forensics and Incident Response (DFIR) Consultant to help organizations investigate, respond to, and recover from complex cybersecurity incidents. In this hands-on role, you will conduct forensic investigations, analyze threats, and support incident response engagements across diverse industries. Working alongside experienced senior consultants and multidisciplinary security teams, you will contribute to identifying threats, understanding attack patterns, and minimizing business impact. You will have opportunities to work across host forensics, network analysis, malware investigations, and threat intelligence. This role offers an environment built around technical excellence, collaboration, continuous learning, and professional development. It is an excellent opportunity to deepen your expertise while helping organizations strengthen their cybersecurity resilience.

• Digital Forensics and Incident Investigations: Conduct hands-on DFIR investigations under the guidance of senior engagement leads, performing host forensics, network traffic analysis, malware handling and triage, log reviews, and Business Email Compromise (BEC) investigations.

• Incident Response Delivery: Support reactive incident response, forensic investigations, proactive threat discovery, threat hunting, and Purple Team exercises in collaboration with offensive security professionals.

• Technical Analysis and Reporting: Analyze forensic evidence, identify suspicious activity, document findings, and produce accurate technical reports outlining investigation results, business impact, and practical remediation recommendations for technical and management audiences.

• Client Engagement and Communication: Support client relationships throughout investigations by communicating technical findings, providing guidance, coordinating activities, and maintaining clear and timely updates.

• Team Collaboration: Work closely with fellow consultants and engagement leads across multiple concurrent engagements, sharing insights and coordinating investigative activities to ensure consistent, high-quality delivery.

• Automation and Process Improvement: Leverage scripting and automation to streamline forensic workflows, reduce repetitive tasks, and improve investigation efficiency.

• Continuous Learning and Development: Stay informed about emerging cyber threats, attacker techniques, investigative methodologies, and industry technologies while continuously developing expertise across core DFIR disciplines.

• Practice Development: Contribute to the evolution of cybersecurity services and investigative capabilities to address emerging threats and changing client requirements.

• Operational Ownership and Availability: Maintain availability outside standard business hours during high-severity incidents, participate in on-call rotations when required, proactively identify delivery or communication gaps, and demonstrate professionalism, initiative, and accountability throughout engagements.

Requirements:

• Education and Experience: High school diploma with at least five years of relevant experience, a bachelor's degree with at least two years of experience, or a master's degree.

• DFIR Technical Expertise: Hands-on experience across core digital forensics and incident response disciplines, including host forensics, network traffic analysis, malware handling and triage, log review, and Business Email Compromise investigations.

• Investigation and Analytical Skills: Ability to investigate complex technical issues, interpret forensic evidence, identify suspicious behavior, and develop effective solutions in rapidly changing environments.

• Communication Skills: Excellent written and verbal communication skills, with the ability to translate complex technical findings into clear, actionable information for both technical and managerial stakeholders.

• Adaptability and Problem-Solving: Strong analytical thinking, creativity, attention to detail, and the ability to adapt to evolving investigative challenges and client priorities.

• Technology Adoption: Demonstrated willingness to embrace emerging technologies, including AI-enabled tools, to improve efficiency, solve problems, and deliver stronger business outcomes.

Preferred qualifications:

• Previous experience in cybersecurity consulting, professional services, or client-facing technical engagements.

• Familiarity with established digital forensics and incident response methodologies and investigative processes.

• Experience with security technologies and platforms such as EDR, NDR, XDR, SIEM, firewalls, NGAV, and Velociraptor.

• Proficiency in scripting and programming languages such as PowerShell, Python, Bash, or Go.

• Experience with enterprise cloud environments, including Amazon Web Services, Google Workspace, Microsoft 365, and Microsoft Azure.

• Understanding of attacker techniques, advanced persistent threat groups, and the application of threat intelligence to incident investigations.

• Relevant industry certifications such as GCFA, GCFE, GCIH, GCIA, GDAT, GREM, or CISSP.

• Travel: Willingness to travel up to 20% depending on client and engagement requirements.

• Working Conditions: Ability to perform primarily sedentary work, including extended computer use, frequent wrist and hand movements, and sustained visual concentration for technical analysis and documentation.

Benefits:

• Primarily remote working environment, available to candidates based in the United States.

• Comprehensive medical insurance options:

  • Zero-deductible PPO plan, with 90% of employee premiums and 70% of family premiums covered by the employer.

  • High-deductible health plan with HSA, with 100% of employee premiums and 75% of family premiums covered by the employer.

  • Annual employer HSA contributions of $850 for individual coverage or $1,750 for family coverage, distributed quarterly.

• Dental insurance, with 100% of employee premiums and 75% of family premiums covered by the employer.

• 12 company holidays annually.

• Flexible Time Off (FTO) program.

• Mobile phone and home internet allowances.

• Eligibility for participation in the retirement plan after two months, subject to enrollment terms.

• Optional pet benefits.

• Professional development opportunities through collaboration with experienced DFIR specialists and cybersecurity professionals.

• Opportunities to work on diverse and challenging cybersecurity investigations across multiple industries.

• Up to 20% travel, providing opportunities for client engagement and professional collaboration.

How Jobgether works:

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1