Cloud DFIR Investigator (Remote)

Booz Allen Hamilton; Illinois; On-site; USD 87,000 - 198,000; Full time

Benefits offered by this job

Health benefits

Paid leave

Tuition assistance

Work-life programs

Retirement benefits

Job summary

Booz Allen Hamilton is seeking a skilled DFIR/IR professional to support incident response for Business Email Compromise investigations. You will collect and analyze logs (M365), develop timelines, and present findings to clients.

Strong scripting (PowerShell) and experience with forensic tools are required. This role requires independent work with guidance, on-call rotations, and the ability to manage multiple incidents simultaneously, including after-hours work.

Qualifications

• 3+ years DFIR/IR/ BEC investigations or related.
• Experience collecting and analyzing logs in Microsoft 365 (M365).
• PowerShell scripting experience in incident response workflows.
• Knowledge of common forensic artifacts analyzed during investigations.
• Ability to correlate events from multiple sources to create a timeline analysis.
• Ability to communicate findings in writing and verbally to clients.
• Ability to lead cloud investigations from start to finish and produce executive summaries.
• Willingness to work after hours and on-call rotations.
• HS diploma or GED required.

Responsibilities

• Display expertise in incident response processes, tools, and techniques.
• Collect, analyze, and present digital evidence for BEC investigations.
• Provide written or verbal updates to clients and stakeholders.
• Lead fast-paced cloud investigations from start to finish and present forensic findings.

Skills

DFIR/IR/BEC

M365 logs

PowerShell scripting

Timeline analysis

Executive reporting

On-call rotation

Education

HS diploma or GED

Tools

EnCase

FTK Axiom

Splunk

ELK Stack

Job description

Booz Allen Hamilton is seeking a skilled DFIR/IR professional to support incident response for Business Email Compromise investigations. You will collect and analyze logs (M365), develop timelines, and present findings to clients.

Strong scripting (PowerShell) and experience with forensic tools are required. This role requires independent work with guidance, on-call rotations, and the ability to manage multiple incidents simultaneously, including after-hours work.