Senior Digital Forensics and Incident Response (DFIR) Consultant - Ireland

AprosSyber; Ireland; Remote; EUR 85,000 - 120,000; Full time

Job summary

AprosSyber in Ireland is seeking a Senior Digital Forensics and Incident Response (DFIR) Consultant who leads small workstreams, coordinates Consultants, and ensures deliverable quality on active engagements. The role blends hands-on DFIR execution with service delivery leadership, working across insurance, legal, and enterprise client projects.

Travel up to 50% to client sites; remote work supported, with on-demand availability for weekends/odd hours as needed.

Qualifications

• 3–5+ years in incident response, digital forensics, or related cybersecurity role.
• GCFA or GCFR certification strongly preferred.
• Coordinate plans, tasks, and risks across a workstream.
• Present interim findings to client stakeholders and deliverables.
• Basic scripting in Python and/or PowerShell for automation.
• Endpoint forensics experience across physical and virtual systems.
• Hands-on EDR experience (CrowdStrike Falcon).
• Familiarity with SIEM, SOAR platforms; threat hunting exposure.

Responsibilities

• Lead small workstreams within incident response engagements.
• Coordinate Consultants and ensure deliverable quality.
• Own workstream planning, stand-ups, and risk tracking.
• Validate outputs and present interim findings to clients.
• Deliver forensic acquisition, IOC triage, and recovery steps.
• Maintain case notes and client-ready artefacts; follow SOPs/QA.
• Escalate risks early; ensure chain-of-custody and compliance.
• Analyze IoCs and logs for suspicious activity.
• Travel to client sites up to 50% with short-notice deployments.

Skills

DFIR Experience

GCFA/GCFR

Python

PowerShell

EDR

SIEM

SOAR

Threat Hunting

Education

Cybersecurity degree

Tools

CrowdStrike Falcon

SIEM

SOAR

Job description

Senior Digital Forensics and Incident Response (DFIR) Consultant - Ireland

Consulting - Ireland (Remote)

About the Role

The Senior Consultant leads small workstreams within active incident response and recovery engagements, coordinating Consultants and ensuring deliverable quality and alignment with client objectives. Operating under the direction of a Manager or Senior Manager, the Senior Consultant owns workstream planning, validates technical outputs, and presents interim findings to client stakeholders — while continuing to execute hands-on DFIR tasks across insurance, legal, and enterprise client engagements. The role sits at the intersection of technical execution and emerging service delivery leadership .

Core Responsibilities

• Understand the client challenge and objective; ensure operational tasks across the workstream are executed in line with the path to recovery.
• Lead small workstreams under the supervision of a Manager or Senior Manager; coordinate task execution across the team and ensure deliverable quality and alignment with client objectives.
• Own workstream planning, stand-ups, and risk tracking across active engagements.
• Validate technical outputs; present interim findings to client stakeholders and manage expectations.
• Deliver discrete work packages including forensic acquisition, IOC triage, and recovery steps.
• Maintain accurate case notes and produce client-ready artefacts; adhere to SOPs and QA standards throughout all engagements.
• Escalate risks early; follow chain-of-custody and compliance requirements at all times .
• Analyze triage collections and artefacts for indicators of compromise ( IoCs ) and potentially malicious activity.
• Review logs from host systems and appliances to identify suspicious activities.
• Collect forensic disk and memory images from physical and virtual endpoints and servers.
• Own and drive event correlation and timeline construction across the engagement.
• Conduct independent threat research based on IOCs collected during investigations, and direct junior team members in targeted research tasks.
• Participate in a rotating on-call schedule; ability to work on weekends and outside normal business hours as needed.
• This role is remote but requires the ability to travel on short notice to a client site up to 50%. Must maintain flexibility to travel within 24–48 hours' notice for deployments typically 1–2 weeks in duration.

Technical Requirements

• 3–5+ years of experience in incident response, digital forensics, or a related cybersecurity role.
• Advanced capability in DFIR analysis — able to perform deeper forensic investigation and lead technical analysis workstreams; GCFA or GCFR certification is strongly preferred.
• Demonstrated ability to coordinate plans, tasks, and risks across an engagement workstream with multiple contributors, maintaining quality and alignment with client objectives.
• Experience presenting interim findings to client stakeholders, managing expectations, and leading the creation of client-ready deliverables.
• Basic scripting proficiency in Python and/or PowerShell to automate forensic or recovery tasks.
• Working knowledge of endpoint forensics — evidence acquisition, preservation, and artifact triage across physical and virtual systems.
• Hands-on experience operating EDR platforms (e.g., CrowdStrike Falcon) for threat hunting, host isolation, and telemetry collection.
• Familiarity with SIEM, SOAR, or IR orchestration platforms.
• Ability to perform estimation and short-cycle planning within an engagement workstream.

Business Responsibilities

• Exhibit strong customer service and consulting skills in all client interactions.
• Adhere to client and internal policies, procedures, and security practices.
• Remain calm, composed, and articulate in high-pressure client situations.
• Exhibit excellent relationship management and communication skills.
• Ensure a high level of confidentiality due to having access to sensitive client and incident data.

Preferred Skills

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field — or equivalent hands-on experience.
• Industry certifications such as GCFA, GCFR, GCIH, CCFR, CCHF, AWS Certified or similar are a strong asset.
• Exposure to threat hunting, network forensics, or malware analysis methodologies.
• Experience in a professional services or consulting environment.