Remote job
Principal Consultant, Digital Forensics and Incident Response (DFIR) (Remote)
Job details
About this role
Role overview
Lead digital forensics and incident response engagements, guiding clients through investigation, containment, and recovery. This principal-level role combines hands-on forensic analysis with independent management of investigations of varied size and complexity, plus technical guidance and career development for a small team. The position is remote in the United States and includes rotating after-hours support.
Responsibilities
- Direct incident response engagements and coordinate the team’s work throughout the response lifecycle. - Independently manage investigations such as ransomware and business email compromise cases. - Analyze forensic evidence to establish incident scope and impact, including malware analysis or reverse engineering when needed. - Advise clients on attack paths and techniques, and explain findings to technical and non-technical stakeholders. - Produce evidence-backed reports and review colleagues’ forensic reports. - Coach a team of consultants, guide development opportunities, and advance investigative methods and processes. - Participate in rotating on-call and weekend coverage for critical incidents.
Requirements
- Extensive experience in digital forensics and incident response, including client-facing work and complex investigations. - Ability to lead investigations independently and prioritize work across concurrent engagements. - Strong forensic analysis skills and a detailed understanding of evolving threats and attacker techniques. - Excellent written and verbal communication for client guidance, technical explanations, and reports. - Demonstrated ability to mentor colleagues and contribute to team expertise. - Capacity to work under pressure and provide rotating after-hours support.
Benefits and work setup
- Full-time remote role based in the United States. - Compensation includes equity; benefits include medical, dental, vision, retirement matching, paid leave, and professional development.