DFIR Consultant

Tokio Marine HCC International; Northern (KY); Hybrid; USD 87,000 - 131,000; Full time

Benefits offered by this job

Competitive salary

6% 401K match

20 days PTO and 2 floating days

Paid parental leave

Strong learning culture

Growth perspectives

Job summary

Vector3, Inc. in collaboration with Tokio Marine HCC CPLG hires a DFIR Consultant to join our incident response team.

You will apply investigative experience to support client incidents from initial triage through preservation, analysis, and reporting, working with a skilled team to deliver timely, defensible findings. You will collaborate across internal stakeholders, clients, and insurers, translating complex technical detail into actionable business guidance while adhering to defensible

Qualifications

• 4+ years of professional experience in digital forensics, incident response, security operations, or related investigative work.
• Experience with endpoint, server, and cloud log analysis in cyber incidents.
• Experience with DFIR tools, evidence handling, and report writing.
• Ability to manage multiple active matters with quality and deadlines.
• Excellent communication skills to explain complex concepts to stakeholders.

Responsibilities

• Perform triage, acquisition, preservation, and analysis of endpoint, server, cloud, and log evidence to determine scope and root cause.
• Develop accurate timelines, identify affected assets, and document findings in a clear and defensible manner.
• Prepare investigation updates and reports translating technical detail into actionable guidance for clients and insurers.

Skills

Digital forensics

Incident response

Security operations

Client communications

Artifact management

Education

Bachelor's degree in cyber security

Computer Science / IT related degree

Tools

DFIR tools

Evidence handling

Job description

## DFIR ConsultantApplylocations: Remote - USAtime type: Full timeposted on: Posted Todayjob requisition id: 2026-812**Job Title: DFIR Consultant** **Location:****Remote, USA** **Reports to: Managing Director** **Employment Type:**Full time **Job Req ID:**2026 **Req Begin Date:** 8/11/2026 **About Vector3** **Vector3, Inc., is an incident response firm** supporting **TMHCC Cyber and Professional Lines Group (CPLG)****.** Vector3 specializes in responding to **Business Email Compromise (BEC)** and **Ransomware** incidents, helping insured organizations investigate, contain, and recover from cyber events. **About TMHCC** Tokio Marine HCC (TMHCC) brings 50 years of service to the specialty insurance industry, today offering over 100 products to commercial customers in 180 countries around the world. Every policy we write is special, enabling our clients to do amazing things. From insuring the crops that feed us to the rock concerts that entertain us, to rescuing international travelers in trouble. Organic growth and over 60 successful acquisitions have grown our 2023 Gross Written Premium (GWP) to over $7.5 Billion. Our workforce has grown to 4,300 worldwide ... big, but not so big that you cannot make a difference. Our Good Company values, including integrity, empowerment, and commitment to customer service, and a culture of innovation, communication, and collaboration make TMHCC a great place to work. **What We Offer*** Competitive salary and employee benefit package* Strong learning culture* Growth perspectives* 6% 401K match* 20 days of PTO and 2 Floating Days* Paid parental leave* An opportunity to love what you do**Job Summary**Join us in shaping the future of TMHCC-CPLG as a key contributor in our Digital Forensics and Incident Response (DFIR) team, Vector3. You will apply your investigative experience to support client incidents from initial triage through evidence preservation, analysis, and reporting. You will work closely with your team on complex investigations, helping deliver timely, accurate, and defensible findings that support recovery and informed decision-making.**Key Responsibilities**Relying on extensive security knowledge and advanced technical expertise, this role is accountable for the following responsibilitiesRelying on advanced knowledge and strong leadership skills, this role is accountable for the following responsibilities:Incident Response and Forensic Analysis:* Perform triage, acquisition, preservation, and analysis of endpoint, server, cloud, and log evidence to determine scope, impact, and root cause.* Develop accurate timelines, identify affected assets and accounts, and document investigative findings in a clear and defensible manner.* Support analysis of malware, suspicious scripts, persistence mechanisms, credential theft, lateral movement, and data theft activity.* Use repeatable methods and validated workflows to ensure evidence integrity and investigation quality.Client Engagement and Communication:* Communicate professionally with internal stakeholders, clients, insurers, legal counsel, and other approved parties during active matters.* Prepare concise updates, investigation notes, and report content that translate technical detail into actionable business and response guidance.* Support status calls, evidence requests, and coordination of next steps across involved teams.Operational Support and Continuous Improvement:* Contribute to playbooks, templates, evidence handling procedures, and knowledge articles that improve team efficiency and consistency.* Identify repeatable investigative tasks that can be standardized, automated, or improved for scale.* Support after-action reviews and lessons learned to strengthen the DFIR practice and client outcomes.**Competencies****Planning*** Contribute to the development of both short-term and long-term plans for designated area of the organization.**Technical Excellence*** Apply strong technical analysis skills to digital forensic evidence, incident data, and client environments.* Write, or is a major contributor to, investigative reports and documentation.* Work accurately under time pressure while maintaining defensible methods and attention to detail.**Cost Management*** Develop innovative ways to improve financials and increase operational efficiency.**Business Controls and Policies*** Comply with all corporate policies and procedures.* Identify control objectives for the designated function and help implement cost effective controls designed to meet those objectives.**Education**Minimum 4 Year / bachelor's degree in cyber security, Computer Science, Information Technology related degree.**Certifications, Licenses, and Designations**Preferred advanced degrees or certifications (CISSP, CISM, GCFE, GCFA, GREM, GBFA, GCIH, CFCE, CCE) are a plus**Experience**2+ years of professional experience in digital forensics, incident response, security operations, or related investigative work.**Other*** Experience performing endpoint, server, and cloud log analysis in support of cyber incidents.* Experience with common DFIR tools, evidence handling, and report writing.* Ability to manage multiple active matters while maintaining quality and deadlines.* Excellent communication skills to clearly and concisely communicate complex technical concepts to stakeholders.The pay range for this position is $87,400-$131,000 which includes geographic adjustments, where applicable. The pay range is the range THMCC, in good faith, believes is the range of compensation for this role at the time of this posting. The hired applicant will be offered pay within the entire range based on the candidate’s geographic location, qualifications, work experience, education, and/or skill level. The Company is fully committed to ensuring equal pay opportunities for equal work regardless of color, race, sex, national origin, sexual orientation, religion, age, veteran status, disability, pregnancy, citizenship status, genetic information, or any other basis protected by federal, state, or local pay equity laws. California → Use CA Fair Chance language. The Company will consider for employment all qualified applicants, including those with criminal histories, in a manner consistent with the requirements of applicable federal, state and local laws, such as the Violent Crime Control and Law Enforcement Act of 1994 (18 USC* 1033(e))(the “VCCLEA”), which restricts financial institutions and insurers such as TMHCC from employing individuals with certain types of criminal convictions. Where the hiring and employment of individuals is not restricted by the foregoing, the Company will consider qualified applicants with arrest or conviction history in compliance with applicable law such as the California Fair Chance Act, the Los Angeles Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance, the San Diego Fair Chance Ordinance, and the San Francisco Fair Chance Ordinance.]As an insurance company, we comply with certain federal, state and local laws such as the Violent Crime Control and Law Enforcement Act of 1994 (18 USC* 1033(e)), which restricts our ability to employ individuals with certain types of criminal convictions. Where not restricted by law and for criminal history not covered by this law, the Company will consider qualified applicants with arrest or conviction history in compliance with applicable law.You do not need to disclose your criminal history or participate in a background check until a conditional job offer is made to you. After making a conditional offer and running a background check, if the Company is concerned about a conviction that is directly related to the job, you will be given the chance to explain the circumstances surrounding the conviction or challenge the accuracy of the background report. The Company will consider for employment all qualified applicants, including those with criminal histories, in a manner consistent with the requirements of applicable federal, state and local laws, such as the Violent Crime Control and Law Enforcement Act of 1994 (18 USC* 1033(e))(the “VCCLEA”), which restricts financial institutions and insurers such as TMHCC from employing individuals with certain types of criminal convictions. Where the hiring and employment of individuals is not restricted by the foregoing, the Company will consider qualified applicants with arrest or conviction history in compliance with applicable law such as the California Fair Chance Act, the Los Angeles Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance, the San Diego Fair Chance Ordinance, and the San Francisco Fair Chance Ordinance.]Applying our Mind Over Risk philosophy to writing insurance allows our customers to take on opportunity with confidence. That philosophy defines our way of thinking, unites us as a team, and differentiates us from our competitors. We are much more than just an insurance company; we are a good company. Equal Opportunity Employer TMHCC is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity, genetic information, marital status, medical condition, national origin, physical or mental disability, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. #CPLG1#VA-LIYour success is our priority. In a world that is rapidly changing, TMHCC enables you to take on opportunities with confidence. At Tokio Marine HCC, we pride ourselves on hiring the smartest, most conscientious people, who want to make a difference no matter their background. And then we give them the support and trust they need. We’re always looking for curious, creative transformative thinkers who want to change the status quo and have a passion for doing the right thing. If this is you, then we want you on our team.