DFIR Manager (Dallas/Fort Worth Area Candidates Only)

Thomas Edwards Group; United States; On-site; USD 150,000 - 200,000; Full time

Job summary

Forensic Focus in the United States is seeking an experienced DFIR leader to drive incident response and digital forensics across multiple business units. You will oversee investigations spanning endpoint, network, memory, mobile, cloud and Microsoft 365 environments.

You will maintain response playbooks, coordinate major incidents, strengthen forensic tooling and evidence handling, and run tabletop exercises and post-incident reviews to mature programs across operating companies.

Qualifications

• 7+ years in incident response or digital forensics.
• 3+ years managing DFIR staff.
• Hands-on experience with AWS, Azure, Kubernetes, Microsoft 365/Entra, and mobile forensics (iOS/Android).
• Familiarity with chain of custody, legal hold, eDiscovery, NIST and MITRE ATT&CK.
• Scripting in KQL, Python or PowerShell.

Responsibilities

• Lead incident response and forensic investigations across endpoint, network, memory, mobile, cloud and Microsoft 365 environments.
• Maintain response playbooks, coordinate major incidents, and strengthen evidence handling.
• Run tabletop exercises and post‑incident reviews to mature programs across operating companies.

Skills

DFIR leadership

Digital forensics

Staff management

Cloud forensics

Forensic tooling

Tools

AWS

Azure

Kubernetes

Microsoft 365/Entra

iOS/Android forensics

Job description

The Role

This position leads incident response and digital forensics activities across multiple business units, overseeing investigations spanning endpoint, network, memory, mobile, cloud and Microsoft 365 environments.

Duties include maintaining response playbooks, coordinating major incidents, strengthening forensic tooling and evidence handling, and running tabletop exercises and post-incident reviews.

Skills & Experience

Requires 7+ years in incident response or digital forensics, with 3+ years managing DFIR staff.

Hands‑on experience with AWS, Azure, Kubernetes, Microsoft 365/Entra, and iOS/Android forensics is expected, alongside chain of custody, legal hold, eDiscovery, NIST and MITRE ATT&CK familiarity, and scripting in KQL, Python or PowerShell.

Who It Suits

Ideal for an experienced DFIR practitioner ready to step into management, combining technical forensic leadership with team development, stakeholder coordination and program maturation across multiple operating companies.