Senior DFIR Consultant: Remote Incident Response Lead

Ransomware Recovery; Ireland; Remote; EUR 110,000 - 140,000; Full time

Job summary

Ransomware Recovery is seeking a Senior Consultant to lead small workstreams within active incident response and recovery engagements. You will coordinate Consultants, validate outputs, and present interim findings to client stakeholders while performing hands-on DFIR tasks across insurance, legal, and enterprise engagements.

The role blends technical execution with service delivery leadership, requiring flexibility for remote work and travel to client sites up to 50% on short notice.

Qualifications

• 3–5+ years in incident response, DFIR, or a related cybersecurity role.
• GCFA/GCFR preferred; strong leadership in workstreams.
• Experience presenting to client stakeholders.
• Proficient scripting to automate tasks (Python/PowerShell).
• Knowledge of endpoint forensics and evidence handling.

Responsibilities

• Lead small workstreams within incident response and recovery engagements, coordinating consultants and ensuring deliverable quality.
• Own workstream planning, stand-ups, and risk tracking across active engagements.
• Validate technical outputs and present interim findings to client stakeholders.
• Deliver discrete work packages including forensic acquisition, IOC triage, and recovery steps.
• Maintain accurate case notes and produce client-ready artefacts following SOPs and QA standards.

Skills

IR leadership

DFIR analysis

Stakeholder communication

Scripting (Python/PowerShell)

Team coordination

On-call readiness

Education

Bachelor's degree in Cybersecurity or related field

Tools

CrowdStrike Falcon

SIEM

SOAR

PowerShell

Job description

Ransomware Recovery is seeking a Senior Consultant to lead small workstreams within active incident response and recovery engagements. You will coordinate Consultants, validate outputs, and present interim findings to client stakeholders while performing hands-on DFIR tasks across insurance, legal, and enterprise engagements.

The role blends technical execution with service delivery leadership, requiring flexibility for remote work and travel to client sites up to 50% on short notice.