Digital Forensics and Incident Response (DFIR) Consultant

Cypfer; United States; Remote; USD 100,000 - 150,000; Full time

Job summary

Cypfer seeks a Senior Consultant to lead small DFIR workstreams within incident response and recovery engagements. The role coordinates Consultants, validates deliverables, and presents interim findings to client stakeholders while continuing hands-on DFIR tasks across insurance, legal, and enterprise client engagements.

The Senior Consultant owns workstream planning, conducts risk tracking, and ensures adherence to SOPs and QA standards, while maintaining strong client relationships and

Qualifications

• 3–5+ years in incident response or digital forensics.
• Advanced DFIR analysis and ability to lead workstreams.
• GCFA/GCFR, GCIH or CCFR are strong assets.
• Experience presenting interim findings to clients.

Responsibilities

• Lead workstreams within incident response engagements.
• Coordinate consultants and ensure deliverable quality.
• Validate outputs and present interim findings to client stakeholders.
• Perform hands-on DFIR tasks across engagements.
• Collect forensic data and drive evidence timelines.
• Maintain case notes and client-ready artefacts.

Skills

Incident response

Digital forensics

Leadership

GCFA/GCFR

Education

Bachelor's degree in Cybersecurity or related field

Tools

CrowdStrike Falcon

PowerShell

Python

Job description

Описание:

The Senior Consultant leads small workstreams within active incident response and recovery engagements, coordinating Consultants and ensuring deliverable quality and alignment with client objectives. Operating under the direction of a Manager or Senior Manager, the Senior Consultant owns workstream planning, validates technical outputs, and presents interim findings to client stakeholders — while continuing to execute hands‑on DFIR tasks across insurance, legal, and enterprise client engagements. The role sits at the intersection of technical execution and emerging service delivery leadership.

Задачи:

Understand the client challenge and objective; ensure operational tasks across the workstream are executed in line with the path to recovery. Lead small workstreams under the supervision of a Manager or Senior Manager; coordinate task execution across the team and ensure deliverable quality and alignment with client objectives. Own workstream planning, stand‑ups, and risk tracking across active engagements. Validate technical outputs; present interim findings to client stakeholders and manage expectations. Deliver discrete work packages including forensic acquisition, IOC triage, and recovery steps. Maintain accurate case notes and produce client‑ready artefacts; adhere to SOPs and QAstandards throughoutall engagements. Escalate risks early;followchain‑of‑custodyandcompliancerequirementsatalltimes. Analyzetriage collections and artefactsforindicatorsofcompromise (IoCs) andpotentiallymalicious activity. Reviewlogsfrom hostsystemsandappliancestoidentifysuspiciousactivities. Collect forensic diskandmemoryimagesfromphysicalandvirtualendpointandservers. Ownanddriveeventcorrelationandtimelineconstructionacrosstheengagement. ConductindependentthreatresearchbasedonIOCscollectedduringinvestigations,anddirectjuniorteammembersintargetedresearchtasks. Participateinarotatingon‑callschedule;abilitytoworkonweekendsandoutsidenormalbusinesshoursasneeded.Thisroleisremotebutrequirestheabilitytotravelonshortnoticetoaclientsite upto50%.Mustmaintainflexibilitytotravelwithin24–48hours'noticefordeploymentstypically1–2weeksinduration.Exhibitstrongcustomerserviceandconsultingskillsinallclientinteractions.Adheretoclientandinternalpolicys.Proceduresandsecuritypractices.Remaincalm,composed,andarticulateinhigh‑pressureclientsituations.Exhibitexcellentrelationshipmanagementandcommunicationskills.Ensureahighlevelofconfidentialityduetoaccessingsensitiveclientandincidentdata.

Требования:

3–5+yearsofexperienceinincidentresponse,digitalforensics,orarelatedcybersecurityrole.AdvancedcapabilityinDFIRanalysis —able to perform deeper forensic investigation and lead technical analysis workstreams; GCFA or GCFR certification is strongly preferred. Demonstrated ability to coordinate plans, tasks, and risks across an engagement workstream with multiple contributors, maintaining quality and alignment with client objectives. Experience presenting interim findings to client stakeholders, managing expectations, and leading the creation of client‑ready deliverables. Basic scripting proficiency in Python and/or PowerShell to automate forensic or recovery tasks. Working knowledge of endpoint forensics — evidence acquisition, preservation, and artifact triage across physical and virtual systems. Hands‑on experience operating EDR platforms (e.g., CrowdStrike Falcon) for threat hunting, host isolation, and telemetry collection. Familiarity with SIEM, SOAR, or IR orchestration platforms. Ability to perform estimation and short-cycle planning within an engagement workstream. Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field — or equivalent hands‑on experience. Industry certifications such as GCFA, GCFR, GCIH, CCFR, CCHF, AWS Certified or similar are a strong asset. Exposure to threat hunting, network forensics, or malware analysis methodologies. Experience in a professional services or consulting environment.