Cyber Defense DFIR Manager

NorthMark Strategies LLC; Dallas (TX); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Company-Paid Lunch Stipend

100% Employer-Paid Medical, Dental and

Vision benefits

Paid Parental Leave

401(k) Company match

Paid Time Off 25 days + holidays

Job summary

NorthMark Strategies LLC is seeking a Cyber Defense DFIR Manager to own incident response and digital forensics across a multi-entity ecosystem. You will lead investigations, maintain incident response plans, and evolve tooling, processes, and playbooks to improve readiness across the organization.

The role demands hands-on forensics across disk, memory, network, cloud, and mobile, plus experience with Microsoft 365/Entra forensics, legal hold, and table-top exercises.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or related field; equivalent experience considered.
• 7+ years in incident response, digital forensics, or security operations with IR plan experience.
• 3+ years of people management or mentoring in IR/forensics.
• Hands-on forensics across disk, memory, network, and cloud data; timeline reconstruction.
• Experience with mobile forensics (iOS/Android).
• Cloud-native forensics across AWS, Azure, and Kubernetes.
• Experience with Microsoft 365/Entra forensics (Purview eDiscovery, Content Search, Graph API).
• Experience producing forensic reports suitable for legal/regulatory use.
• Experience building or maintaining forensic lab infrastructure and chain-of-custody.
• Ability to design/tabletop exercises and drive readiness across multiple entities.
• Experience maturing IR/DFIR functions and cross-entity workflows.
• Knowledge of legal hold/eDiscovery processes across multi-entity environments.
• Proficiency with KQL, Python, or PowerShell; knowledge of Microsoft security ecosystem.
• Familiarity with MITRE ATT&CK and NIST SP 800-61; threat intelligence integration.
• Professional certifications such as GCFE/GCFA/EN CE/GREM/CISSP desirable.

Responsibilities

• Maintain and update the enterprise incident response plan and entity-specific playbooks.
• Mature and operationalize the DFIR function, strengthen tooling and workflows.
• Lead investigations across disk, memory, network, cloud, and mobile evidence.
• Perform Microsoft 365/Entra forensics investigations and evidence collection.
• Produce clear forensic reports for legal, regulatory, and potential litigation needs.
• Develop and manage the DFIR lab, including write-blockers and secure storage.
• Oversee legal hold/eDiscovery processes across multiple entities.
• Serve as incident commander or deputy for significant incidents and post-incident reviews.
• Design and run tabletop exercises; manage exercise calendar and after-action reports.
• Collaborate with cross-entity leadership to standardize incident readiness.
• Partner with SIEM/detection engineering to ensure smooth handoff from detection to response.
• Evaluate AI/automation to accelerate triage and timeline reconstruction.

Skills

Incident response

Digital forensics

Team leadership

Table top exercises

Cloud forensics

Microsoft 365/Entra forensics

Regulatory/compliance reporting

Python/PowerShell

Forensic lab/infrastructure

Threat intelligence integration

Education

Bachelor’s degree in Computer Science or Information Security

Tools

Magnet AXIOM

Magnet Nexus

X-Ways Forensics

Magnet Verakey

Job description

Cyber Defense DFIR Manager### Cyber Defense DFIR ManagerApply: Dallas TX: Posted 6 Days Ago: R13442**Cyber Defense DFIR Manager** **The Company**NorthMark Strategies is a leading strategic capital firm, combining capital, innovation, and engineering to drive long-term value. From operating complex businesses to backing breakthrough technologies, our mission is to deploy capital and build enduring businesses. Our team combines intelligent risk-taking, operational excellence, exceptional talent, and world-class computing capacity to create shareholder value.Our company offers a dynamic environment where individuals have the freedom to lead companies toward bold achievements by embracing innovation, leveraging technology, and fostering differentiated business strategies. Our values are Integrity, Ability, and Energy, and the company aims to hire individuals who possess those qualities.At NorthMark Strategies, we believe the future isn’t something to hope for, it’s something to build. We don’t just invest, we create. Bringing together strategic insight and technical horsepower to deliver outcomes that endure. **The Position**The **Cyber Defense DFIR Manager** reports to the Director of Cyber Defense and operates within the Office of the CISO. This role owns incident response and digital forensics as a dedicated discipline within the cyber defense function, maintaining and continuously improving the incident response program and entity-specific incident response playbooks across NorthMark Strategies’ diverse ecosystem of operating companies spanning quantitative research, banking, motorsport, and advanced technology ventures.Foundational elements of the DFIR function already exist. The DFIR Manager will build on them further, operationalize them, and mature the function overall: strengthening forensic standards and tooling, growing incident response capability and bench strength, and designing and leading table top exercises and simulations that pressure-test the organization’s readiness across the Ecosystem. The role is also an incident command resource for significant incidents, partnering closely across cyber defense to ensure a seamless path from detection through investigation, containment, and recovery.The ideal candidate pairs hands-on digital forensics and incident response expertise with a track record of maintaining incident response plans in a multi-entity environment, direct experience managing and developing a DFIR/IR team, and the program-building instincts to operationalize and mature a DFIR function that is already underway. **Responsibilities*** **Incident response plan maintenance:** Maintain and continuously update the enterprise incident response plan and entity-specific incident response playbooks across the Ecosystem, ensuring every entity has a current, actionable, and legally defensible plan that reflects its regulatory and operational context.* **Operationalize and mature the DFIR function:** Build on the foundational elements already in place to further operationalize and mature DFIR as a dedicated capability, strengthening tooling, workflows, evidence-handling standards, and operational metrics, and growing the organization’s overall incident response maturity and bench strength over time.* **Digital forensics:** Lead forensic investigations across host, network, cloud (including AWS, Azure, and containerized/Kubernetes environments), mobile (iOS/Android), and memory evidence in support of security incidents, insider risk cases, and legal/HR matters. Establish and enforce chain-of-custody and evidence-handling practices that hold up to regulatory and legal scrutiny.* **Microsoft 365 and Entra forensics:** Lead forensic investigations natively within the Microsoft ecosystem, including Unified Audit Log analysis, Microsoft Purview eDiscovery and Content Search, and Graph API-based evidence collection, reflecting where the majority of the organization’s evidence resides.* **Forensic reporting and litigation readiness:** Produce clear, defensible forensic findings and reports suitable for legal, regulatory, and potential litigation use, including supporting declarations or expert-witness needs as required.* **Forensic lab and evidence management:** Build and maintain the organization’s forensic lab and evidence-handling infrastructure, including write-blockers, forensic workstations, secure evidence storage, and hashing/validation procedures.* **Legal hold and eDiscovery:** Mature legal hold and eDiscovery processes across all entities, partnering with Legal to ensure timely preservation notices, defensible identification and collection, custodian tracking, and chain-of-custody for data subject to litigation holds or regulatory requests.* **Incident command:** Serve as incident commander or deputy on significant incidents, coordinating cross-functional response across IT, legal, HR, and entity leadership. Lead post-incident reviews, root cause analysis, and tracking of corrective actions to closure.* **Table top exercises and readiness:** Design, organize, and run table top exercises and simulations across the Ecosystem to test incident response plans, build muscle memory ahead of real events, and surface and remediate gaps. Own the exercise calendar and after-action reporting.* **Cross-entity standardization:** Partner with entity leadership and IT to maintain consistent incident response readiness across the multi-tenant Ecosystem, including a federally regulated banking entity, adapting plans to entity-specific regulatory and reporting obligations.* **Partnership across cyber defense:** Work closely with SIEM/detection engineering and other cyber defense functions to ensure a seamless handoff from detection into investigation and response, and that forensic findings feed back into detection priorities.* **AI-enabled DFIR:** Evaluate and adopt AI and automation to accelerate triage, evidence correlation, and timeline reconstruction in forensic investigations, consistent with the organization’s broader agentic cyber defense direction.* **Threat intelligence integration:** Incorporate relevant IOCs, TTPs, and adversary tradecraft into incident response playbooks and forensic investigation methodology.* **Reporting and stakeholder engagement:** Report on incident response posture, exercise outcomes, and DFIR metrics to the Director of Cyber Defense and other stakeholders. Support audits, examinations, and legal matters as required.* **Team leadership:** Build, manage, and develop a team of incident response and forensics professionals, owning hiring, performance development, workload and on-call rostering, and casework quality as the team grows alongside the function. **Requirements*** Bachelor’s degree in Computer Science, Information Security, or a related field; equivalent experience considered in lieu of a degree.* 7+ years of progressive experience in incident response, digital forensics, or security operations, including direct experience maintaining incident response plans or playbooks.* 3+ years of experience directly managing or mentoring incident response/forensics professionals, including performance development, workload prioritization, and on-call rostering.* Hands-on digital forensics experience across disk, memory, network, and cloud evidence, including timeline reconstruction and malware/triage analysis.* Experience with mobile device forensics (iOS/Android acquisition and analysis).* Experience with cloud-native forensics across AWS, Azure, and containerized/Kubernetes environments.* Experience with Microsoft 365/Entra-native forensic investigation, including Purview eDiscovery/Content Search, Unified Audit Log analysis, and Graph API-based evidence collection.* Experience producing forensic reports and documentation suitable for legal or regulatory proceedings, including litigation support or expert-witness readiness.* Experience building or maintaining forensic lab infrastructure, including write-blockers, forensic workstations, and secure evidence storage and chain-of-custody systems.* Demonstrated experience designing, organizing, and running table top exercises or incident response simulations.* Experience operationalizing or maturing an incident response or DFIR function, including evolving tooling, workflows, and standards within an existing program.* Experience building or maturing legal hold and eDiscovery processes, including preservation notices, custodian tracking, and defensible collection, ideally across a multi-entity environment.* Working knowledge of the Microsoft security ecosystem (Sentinel, Defender suite, Entra ID); proficiency with KQL, Python, or PowerShell* Experience with forensic and IR tooling such as Magnet AXIOM, Magnet Nexus, X-Ways Forensics, and Magnet Verakey, and with EDR-integrated forensic workflows.* Strong command of incident response and forensic frameworks, including NIST SP 800-61 and MITRE ATT&CK, and experience operationalizing threat intelligence into response work.* Experience operating in multi-tenant, multi-entity, or MSSP-like environments a plus.* Possession of, or ability to obtain, professional certifications such as GCFE, GCFA, GNFA, GREM, EnCE, CHFI, or CISSP.* Exceptional written and verbal communication skills, with the ability to lead calmly and clearly under pressure during live incidents and convey findings to technical and non-technical stakeholders alike.* High level of personal integrity and the ability to professionally handle confidential and sensitive matters. *It is impossible to list every requirement for, or responsibility of, any position. Similarly, we cannot identify all the skills a position may require since job responsibilities and the Company’s needs may change over time. Therefore, the above job description is not comprehensive or exhaustive. The Company reserves the right to adjust, add to or eliminate any aspect of the above description. The Company also retains the right to require all employees to undertake additional or different job responsibilities when necessary to meet business needs.*Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future. **Benefits & Perks*** **Company-Paid Lunch Stipend:** Lunch is provided via GrubHub.* **Company-Paid Benefits:** 100% Employer-Paid Medical in our High-Deductible Health Plan, Dental and Vision benefits for employees and their families, 16 weeks of Paid Parental Leave, Employee Assistance Program, Life insurance, Short-Term Disability and Long-Term Disability.* **401(k):** Company will match 100% of your contributions up to 6%.* **Optional Employee-Paid Benefits:** Medical insurance in our PPO plan and a variety of other benefits such as Health Savings Accounts (with Company Contribution!), Flexible Spending Accounts, Supplemental Life Insurance, Wellhub and more.* **Time Off:** 25 days of Paid Time Off plus 12 company holidays. **Equal Opportunity Employer**NORTHMARK STRATEGIES LLC IS AN EQUAL EMPLOYMENT OPPORTUNITY EMPLOYER. THE COMPANY’S POLICY IS NOT TO DISCRIMINATE AGAINST ANY APPLICANT OR EMPLOYEE BASED ON RACE, COLOR, RELIGION, NATIONAL ORIGIN, GENDER, AGE, SEXUAL ORIENTATION, GENDER IDENTITY OR EXPRESSION, MARITAL STATUS, MENTAL OR PHYSICAL DISABILITY, AND GENETIC INFORMATION, OR ANY OTHER BASIS PROTECTED BY APPLICABLE LAW. THE FIRM ALSO PROHIBITS HARASSMENT OF APPLICANTS OR EMPLOYEES BASED ON ANY OF THESE PROTECTED CATEGORIES.*It is impossible to list every requirement for, or responsibility of, any position. Similarly, we cannot identify all the skills a position may require since job responsibilities and the Company’s needs may change over time. Therefore, the above job description is not comprehensive or exhaustive. The Company reserves the right to adjust, add to or eliminate any aspect of the above description. The Company also retains the right to require all employees to undertake additional or different job responsibilities when necessary to meet business needs.***Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future.****Benefits & Perks:*** **Company-Paid Lunch Stipend**: Lunch is provided via GrubHub* **Company-Paid Benefits:** 100% Employer-Paid Medical in our High Deductible Health Plan, Dental and Vision benefits for employees and their families, 16 weeks of Paid Parental Leave, Employee Assistance Program, Life insurance, Short-Term Disability and Long-Term Disability* **401(k):** Company will match 100% of your contributions up to 6%* **Optional Employee-Paid Benefits:** Medical insurance in our PPO plan and a variety of other benefits such as Health Savings Accounts (with Company Contribution!), Flexible Spending Accounts, Supplemental Life Insurance, Wellhub and more.* **Time Off:** 25 days of Paid Time Off plus 12 company holidays**EQUAL OPPORTUNITY EMPLOYER**NORTHMARK STRATEGIES LLC IS AN EQUAL EMPLOYMENT OPPORTUNITY EMPLOYER. THE COMPANY'S POLICY IS NOT TO DISCRIMINATE AGAINST ANY APPLICANT OR EMPLOYEE BASED ON RACE, COLOR, RELIGION, NATIONAL ORIGIN, GENDER, AGE, SEXUAL ORIENTATION, GENDER IDENTITY OR EXPRESSION, MARITAL STATUS, MENTAL OR PHYSICAL DISABILITY, AND GENETIC INFORMATION, OR ANY OTHER BASIS PROTECTED BY APPLICABLE LAW. THE FIRM ALSO PROHIBITS HARASSMENT OF APPLICANTS OR EMPLOYEES BASED ON ANY OF THESE PROTECTED CATEGORIES.