DFIR Consultant

Jobgether; Oregon; Hybrid; USD 120,000 - 170,000; Full time

Benefits offered by this job

Remote‑friendly environment in the U.S

Medical insurance

HSA contributions

Holiday and PTO

Job summary

Partner Company is seeking a skilled Digital Forensics and Incident Response (DFIR) Consultant based in the United States to investigate, respond to, and recover from complex cybersecurity incidents.

You will conduct hands-on DFIR investigations, analyze threats, and support incident response engagements across diverse industries, collaborating with senior consultants and security teams. This role emphasizes technical excellence, collaboration, and ongoing professional development.

Qualifications

• Five years of relevant experience in DFIR or a related field, or a Master’s degree with relevant work.
• Hands-on experience across host forensics, network traffic analysis, malware handling, and BEC investigations.

Responsibilities

• Conduct hands-on DFIR investigations under senior leads, including host forensics, network traffic analysis, malware handling and triage, and log reviews.
• Support reactive incident response, proactive threat discovery, threat hunting, and Purple Team exercises.
• Analyze forensic evidence, document findings, and produce technical reports for technical and management audiences.
• Communicate findings and guidance to clients, coordinating activities and ensuring timely updates.

Skills

DFIR investigations

Incident response

Threat analysis

Client communication

Automation scripting

Education

GCFA / GCFE / GCIH / GCIA / GDAT / GREM / CISSP

Tools

PowerShell

Python

Bash

Go

EDR

SIEM

Velociraptor

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a DFIR Consultant based in the United States. We are seeking a skilled Digital Forensics and Incident Response (DFIR) Consultant to help organizations investigate, respond to, and recover from complex cybersecurity incidents. In this hands‑on role, you will conduct forensic investigations, analyze threats, and support incident response engagements across diverse industries. Working alongside experienced senior consultants and multidisciplinary security teams, you will contribute to identifying threats, understanding attack patterns, and minimizing business impact. You will have opportunities to work across host forensics, network analysis, malware investigations, and threat intelligence. This role offers an environment built around technical excellence, collaboration, continuous learning, and professional development. It is an excellent opportunity to deepen your expertise while helping organizations strengthen their cybersecurity resilience.

Accountabilities

• Digital Forensics and Incident Investigations: Conduct hands‑on DFIR investigations under the guidance of senior engagement leads, performing host forensics, network traffic analysis, malware handling and triage, log reviews, and Business Email Compromise (BEC) investigations.
• Incident Response Delivery: Support reactive incident response, forensic investigations, proactive threat discovery, threat hunting, and Purple Team exercises in collaboration with offensive security professionals.
• Technical Analysis and Reporting: Analyze forensic evidence, identify suspicious activity, document findings, and produce accurate technical reports outlining investigation results, business impact, and practical remediation recommendations for technical and management audiences.
• Client Engagement and Communication: Support client relationships throughout investigations by communicating technical findings, providing guidance, coordinating activities, and maintaining clear and timely updates.
• Team Collaboration: Work closely with fellow consultants and engagement leads across multiple concurrent engagements, sharing insights and coordinating investigative activities to ensure consistent, high‑quality delivery.
• Automation and Process Improvement: Leverage scripting and automation to streamline forensic workflows, reduce repetitive tasks, and improve investigation efficiency.
• Continuous Learning and Development: Stay informed about emerging cyber threats, attacker techniques, investigative methodologies, and industry technologies while continuously developing expertise across core DFIR disciplines.
• Practice Development: Contribute to the evolution of cybersecurity services and investigative capabilities to address emerging threats and changing client requirements.
• Operational Ownership and Availability: Maintain availability outside standard business hours during high‑severity incidents, participate in on‑call rotations when required, proactively identify delivery or communication gaps, and demonstrate professionalism, initiative, and accountability throughout engagements.

Requirements

• Education and Experience: High school diploma with at least five years of relevant experience, a bachelor's degree with at least two years of experience, or a master's degree.
• DFIR Technical Expertise: Hands‑on experience across core digital forensics and incident response disciplines, including host forensics, network traffic analysis, malware handling and triage, log review, and Business Email Compromise (BEC) investigations.
• Investigation and Analytical Skills: Ability to investigate complex technical issues, interpret forensic evidence, identify suspicious behavior, and develop effective solutions in rapidly changing environments.
• Communication Skills: Excellent written and verbal communication skills, with the ability to translate complex technical findings into clear, actionable information for both technical and managerial stakeholders.
• Adaptability and Problem‑Solving: Strong analytical thinking, creativity, attention to detail, and the ability to adapt to evolving investigative challenges and client priorities.
• Technology Adoption: Demonstrated willingness to embrace emerging technologies, including AI‑enabled tools, to improve efficiency, solve problems, and deliver stronger business outcomes.

Preferred qualifications

• Previous experience in cybersecurity consulting, professional services, or client‑facing technical engagements.
• Familiarity with established digital forensics and incident response methodologies and investigative processes.
• Experience with security technologies and platforms such as EDR, NDR, XDR, SIEM, firewalls, NGAV, and Velociraptor.
• Proficiency in scripting and programming languages such as PowerShell, Python, Bash, or Go.
• Experience with enterprise cloud environments, including Amazon Web Services, Google Workspace, Microsoft 365, and Microsoft Azure.
• Understanding of attacker techniques, advanced persistent threat groups, and the application of threat intelligence to incident investigations.
• Relevant industry certifications such as GCFA, GCFE, GCIH, GCIA, GDAT, GREM, or CISSP.
• Travel: Willingness to travel up to 20% depending on client and engagement requirements.
• Working Conditions: Ability to perform primarily sedentary work, including extended computer use, frequent wrist and hand movements, and sustained visual concentration for technical analysis and documentation.

Benefits

• Primarily remote working environment, available to candidates based in the United States.
• Comprehensive medical insurance options:
  • Zero‑deductible PPO plan, with 90% of employee premiums and 70% of family premiums covered by the employer.
  • High‑deductible health plan with HSA, with 100% of employee premiums and 75% of family premiums covered by the employer.
  • Annual employer HSA contributions of $850 for individual coverage or $1,750 for family coverage, distributed quarterly.
• Dental insurance, with 100% of employee premiums and 75% of family premiums covered by the employer.
• 12 company holidays annually.
• Flexible Time Off (FTO) program.
• Mobile phone and home internet allowances.
• Eligibility for participation in the retirement plan after two months, subject to enrollment terms.
• Optional pet benefits.
• Professional development opportunities through collaboration with experienced DFIR specialists and cybersecurity professionals.
• Opportunities to work on diverse and challenging cybersecurity investigations across multiple industries.
• Up to 20% travel, providing opportunities for client engagement and professional collaboration.