Principal Consultant – DFIR

Forensic Focus Limited; Netherlands; Remote; EUR 78,000 - 91,000; Full time

Job summary

Forensic Focus Limited is seeking a Principal Consultant in DFIR to lead technical engagements from triage to remediation in a high-pressure environment at our Rijswijk, South Holland office. You will coordinate teams, perform investigations, and deliver expert client reports while mentoring colleagues.

The role emphasizes deep technical expertise in host forensics, memory/log analysis, network investigations, EDR tooling and malware analysis, with a focus on communicating security posture to

Qualifications

• Substantial experience in incident response, security operations, or security consulting.
• Strong grounding in host forensics, memory and log analysis, network investigation, EDR tooling and malware analysis.
• Familiarity with case management systems and the ability to communicate security posture clearly to clients.

Responsibilities

• Lead technical engagements across digital forensics and incident response, managing emergencies from triage through remediation.
• Coordinate team workflows, conduct intelligence-driven investigations, and produce high-quality client deliverables.
• Contribute to cyber threat assessments and fulfill line management and mentoring responsibilities.

Skills

Incident response

Security operations

Security consulting

Host forensics

Memory analysis

Log analysis

Network investigation

EDR tooling

Malware analysis

Client communication

Job description

# Principal Consultant – DFIR*Fox-IT***Rijswijk, South Holland**Onsite · Lead/Principal · Full-time### The RoleThis position leads technical engagements across digital forensics and incident response, managing emergency situations from initial triage through remediation. Day to day, the consultant coordinates team workflows, conducts intelligence-driven investigations, produces high-quality client deliverables, and contributes to cyber threat assessments while also fulfilling line management and mentoring responsibilities.### Skills & ExperienceCandidates require substantial experience in incident response, security operations, or security consulting, with strong technical grounding in host forensics, memory and log analysis, network investigation, EDR tooling, and malware analysis. Familiarity with case management systems and the ability to communicate security posture clearly to clients is expected.### Who It SuitsThis role suits a seasoned DFIR professional who thrives in high-pressure, fast-moving environments and is ready to step into a leadership capacity. Someone who balances deep technical expertise with strong communication skills and a genuine interest in developing colleagues will find this position a natural fit.Typical advertised salary forIncident Response roles in Netherlands:**€78,000–€91,000**(median €80,000 — from13 recent listings analysed by Forensic Focus).Compare Incident Response salaries in Netherlands →Learn More/Apply