Cyber Defense DFIR Manager

Northmark Ltd; Dallas (TX); On-site; USD 150,000 - 190,000; Full time

Job summary

NorthMark Strategies is seeking a Cyber Defense DFIR Manager to own incident response and digital forensics across its diverse ecosystem, spanning quantitative research, banking, motorsport, and advanced technology ventures.

The role will build on foundational DFIR elements, maturing the function through tooling, playbooks, and exercises, while serving as incident commander or deputy for significant incidents and coordinating cross-functional response with IT, Legal, HR, and leadership.

Responsibilities

• Incident response plan maintenance across the Ecosystem ensuring current, actionable, legally defensible playbooks.
• Operationalize and mature the DFIR function: Build on foundational elements to strengthen tooling, workflows, and bench strength.
• Digital forensics: Lead investigations across host, network, cloud (AWS, Azure, Kubernetes), mobile, and memory evidence.
• Microsoft 365 and Entra forensics: Lead forensic investigations in the Microsoft ecosystem.
• Forensic reporting and litigation readiness: Produce clear forensic findings for legal, regulatory, and potential litigation use.
• Forensic lab and evidence management: Build and maintain the forensic lab, write-blockers, secure storage, and hashing procedures.
• Legal hold and eDiscovery: Mature holds and eDiscovery processes with Legal for preservation and custody tracking.
• Incident command: Serve as incident commander or deputy on significant incidents and lead post-incident reviews.
• Table top exercises and readiness: Design, organize, and run exercises to test incident response readiness across the Ecosystem.

Job description

Cyber Defense DFIR Manager

The Company

NorthMark Strategies is a leading strategic capital firm, combining capital, innovation, and engineering to drive long-term value. From operating complex businesses to backing breakthrough technologies, our mission is to deploy capital and build enduring businesses. Our team combines intelligent risk-taking, operational excellence, exceptional talent, and world-class computing capacity to create shareholder value.

Our company offers a dynamic environment where individuals have the freedom to lead companies toward bold achievements by embracing innovation, leveraging technology, and fostering differentiated business strategies. Our values are Integrity, Ability, and Energy, and the company aims to hire individuals who possess those qualities.

At NorthMark Strategies, we believe the future isn’t something to hope for, it’s something to build. We don't just invest, we create. Bringing together strategic insight and technical horsepower to deliver outcomes that endure.

The Position

The Cyber Defense DFIR Manager reports to the Director of Cyber Defense and operates within the Office of the CISO. This role owns incident response and digital forensics as a dedicated discipline within the cyber defense function, maintaining and continuously improving the incident response program and entity-specific incident response playbooks across NorthMark Strategies' diverse ecosystem of operating companies spanning quantitative research, banking, motorsport, and advanced technology ventures.

Foundational elements of the DFIR function already exist. The DFIR Manager will build on them further, operationalize them, and mature the function overall: strengthening forensic standards and tooling, growing incident response capability and bench strength, and designing and leading table top exercises and simulations that pressure-test the organization's readiness across the Ecosystem. The role is also an incident command resource for significant incidents, partnering closely across cyber defense to ensure a seamless path from detection through investigation, containment, and recovery.

The ideal candidate pairs hands-on digital forensics and incident response expertise with a track record of maintaining incident response plans in a multi-entity environment, direct experience managing and developing a DFIR/IR team, and the program-building instincts to operationalize and mature a DFIR function that is already underway.

Responsibilities

• Incident response plan maintenance: Maintain and continuously update the enterprise incident response plan and entity-specific incident response playbooks across the Ecosystem, ensuring every entity has a current, actionable, and legally defensible plan that reflects its regulatory and operational context.
• Operationalize and mature the DFIR function: Build on the foundational elements already in place to further operationalize and mature DFIR as a dedicated capability, strengthening tooling, workflows, evidence-handling standards, and operational metrics, and growing the organization's overall incident response maturity and bench strength over time.
• Digital forensics: Lead forensic investigations across host, network, cloud (including AWS, Azure, and containerized/Kubernetes environments), mobile (iOS/Android), and memory evidence in support of security incidents, insider risk cases, and legal/HR matters. Establish and enforce chain-of-custody and evidence-handling practices that hold up to regulatory and legal scrutiny.
• Microsoft 365 and Entra forensics: Lead forensic investigations natively within the Microsoft ecosystem, including Unified Audit Log analysis, Microsoft Purview eDiscovery and Content Search, and Graph API-based evidence collection, reflecting where the majority of the organization's evidence resides.
• Forensic reporting and litigation readiness: Produce clear, defensible forensic findings and reports suitable for legal, regulatory, and potential litigation use, including supporting declarations or expert-witness needs as required.
• Forensic lab and evidence management: Build and maintain the organization's forensic lab and evidence-handling infrastructure, including write-blockers, forensic workstations, secure evidence storage, and hashing/validation procedures.
• Legal hold and eDiscovery: Mature legal hold and eDiscovery processes across all entities, partnering with Legal to ensure timely preservation notices, defensible identification and collection, custodian tracking, and chain-of-custody for data subject to litigation holds or regulatory requests.
• Incident command: Serve as incident commander or deputy on significant incidents, coordinating cross-functional response across IT, legal, HR, and entity leadership. Lead post-incident reviews, root cause analysis, and tracking of corrective actions to closure.
• Table top exercises and readiness: Design, organize, and run table top exercises and simulations across the Ecosystem to test incident resp