CERT Lead

Forensic Focus Limited; New York (NY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Forensic Focus Limited in New York is seeking a senior DFIR leader to head a six-person team and serve as the city’s primary escalation point for major cybersecurity incidents.

You will direct investigations across log, file, malware, memory, disk and network forensics; coordinate cloud IR across AWS, Azure, and GCP; and work with city agencies and external partners around the clock.

Qualifications

• Extensive incident response lifecycle experience, including forensics, malware analysis, threat hunting, and cloud environments.
• Experience with cyber threat intelligence teams, tabletop exercises, and detection capability development.
• Bachelor's degree and minimum four years of DFIR experience required.

Responsibilities

• Direct investigations of high-profile cybersecurity incidents as the primary escalation point.
• Lead a six-person DFIR team and coordinate remediation with city agencies and external partners.
• Oversee cloud incident response across AWS, Azure, and GCP.
• Operate around the clock to respond to escalating incidents.

Skills

Incident response

Digital forensics

Malware analysis

Threat hunting

Cloud environments

Tabletop exercises

Detection capabilities

Education

Bachelor's degree

4+ years DFIR experience

Job description

The Role

This role leads a team of six DFIR specialists acting as the city's primary escalation point for high-profile cybersecurity incidents. Day-to-day responsibilities include directing investigations involving log, file, malware, memory, disk and network forensics, overseeing cloud incident response across AWS, Azure and GCP, and coordinating remediation with city agencies and external partners around the clock.

Skills & Experience

Candidates need deep practical expertise across the full incident response lifecycle, including digital forensics, malware analysis, threat hunting, and enterprise cloud environments. Experience working with cyber threat intelligence teams, designing tabletop exercises, and developing detection capabilities is expected. A relevant degree and at least four years of qualifying experience are required.

Who It Suits

This position suits a seasoned DFIR practitioner ready to step into a leadership role within government cybersecurity. Those with experience managing technical teams, engaging with law enforcement or federal partners, and operating within large, complex organisational environments will find this role a strong fit.