DFIR Lead — Incident Response & Forensics

Northmark Ltd; Dallas (TX); On-site; USD 150,000 - 190,000; Full time

Job summary

NorthMark Strategies is seeking a Cyber Defense DFIR Manager to own incident response and digital forensics across its diverse ecosystem, spanning quantitative research, banking, motorsport, and advanced technology ventures.

The role will build on foundational DFIR elements, maturing the function through tooling, playbooks, and exercises, while serving as incident commander or deputy for significant incidents and coordinating cross-functional response with IT, Legal, HR, and leadership.

Responsibilities

• Incident response plan maintenance across the Ecosystem ensuring current, actionable, legally defensible playbooks.
• Operationalize and mature the DFIR function: Build on foundational elements to strengthen tooling, workflows, and bench strength.
• Digital forensics: Lead investigations across host, network, cloud (AWS, Azure, Kubernetes), mobile, and memory evidence.
• Microsoft 365 and Entra forensics: Lead forensic investigations in the Microsoft ecosystem.
• Forensic reporting and litigation readiness: Produce clear forensic findings for legal, regulatory, and potential litigation use.
• Forensic lab and evidence management: Build and maintain the forensic lab, write-blockers, secure storage, and hashing procedures.
• Legal hold and eDiscovery: Mature holds and eDiscovery processes with Legal for preservation and custody tracking.
• Incident command: Serve as incident commander or deputy on significant incidents and lead post-incident reviews.
• Table top exercises and readiness: Design, organize, and run exercises to test incident response readiness across the Ecosystem.

Job description

NorthMark Strategies is seeking a Cyber Defense DFIR Manager to own incident response and digital forensics across its diverse ecosystem, spanning quantitative research, banking, motorsport, and advanced technology ventures.

The role will build on foundational DFIR elements, maturing the function through tooling, playbooks, and exercises, while serving as incident commander or deputy for significant incidents and coordinating cross-functional response with IT, Legal, HR, and leadership.