Incident Response Consultant (Remote)

Role overview Investigate security incidents and help organizations understand and contain targeted attacks. You’ll work as a technical contributor on client engagements, using host, network, and other evidence to assess intrusions and communicate findings to business, legal, and regulatory audiences.

Responsibilities - Analyze endpoint and network evidence across Windows, macOS, and Linux environments to establish the scope and nature of a compromise. - Hunt for malicious activity in large datasets and apply investigative methods suited to each engagement. - Work with project leads and outside counsel on intrusion investigations. - Help develop practical remediation recommendations for affected organizations. - Prepare clear written reports, presentations, and verbal briefings for technical and executive stakeholders.

Requirements - Experience in incident response, security investigations, or a related information security field; relevant strengths may include one or more of the areas below. - Knowledge of computer forensics and tools used to determine the extent of a compromise. - Understanding of network protocols and network forensic analysis, including interpreting logs and using tools such as Zeek or Suricata. - Familiarity with static or dynamic malware analysis and the ability to assess malware capabilities. - Strong communication skills, sound investigative judgment, and the ability to work independently while collaborating with customers and internal teams. - Relevant experience may also include cloud incident response, secure network operations, or developing tactical and strategic remediation plans.

Nice to have Experience investigating sophisticated threats, such as state-sponsored activity, cybercrime, or hacktivism; familiarity with incident response in AWS, Azure, or Google Cloud; and experience applying AI tools to improve analysis or workflows.