Digital Forensics and Incident Response (DFIR) Consultant

Cypfer; United States; On-site; USD 70,000 - 110,000; Full time

Job summary

Cypfer is seeking a Consultant to join its DFIR and Post-Breach Recovery practice in the United States. The role is hands-on and involves working with insurance partners, legal counsel, client technical teams, and executives to deliver structured incident response and recovery engagements.

You'll perform evidence collection, playbook execution, IOC triage, and client-ready documentation, with opportunities to contribute to timelines, threat research, and on-call rotation, including occasional

Qualifications

• 1-3 years of experience in incident response, digital forensics, or a related cybersecurity role.
• Working knowledge of endpoint forensics - acquire and preserve evidence from physical and virtual systems, and triage artefacts to support investigations; SANS FOR500 (GCFE) certification is an asset.
• Hands-on experience operating EDR platforms (e.g., CrowdStrike Falcon) for threat hunting, host isolation, and telemetry collection; vendor EDR certification (e.g., Falcon Administrator) is an asset.
• Ability to execute DFIR and PBR playbooks accurately under guidance, following structured SOPs from initial triage through to recovery.
• Ability to produce clear, accurate, client-ready case notes and reports throughout an engagement.
• Familiarity with IR orchestration platforms or case management tooling is an asset.

Responsibilities

• Understand the client challenge and objective; execute defined tasks in line with engagement scope and the path to recovery.
• Deliver discrete work packages including forensic acquisition, IOC triage, and recovery steps under the direction of senior team members.
• Maintain accurate case notes and produce client-ready artefacts; adhere to SOPs and QA standards throughout all engagements.
• Escalate risks early; follow chain-of-custody and compliance requirements at all times.
• Analyze triage collections and artefacts for indicators of compromise (IoCs) and potentially malicious activity.
• Review logs from host systems and appliances to identify suspicious activities.
• Collect forensic disk and memory images from physical and virtual endpoints and servers.
• Contribute to event correlation and the building of engagement timelines under senior guidance.
• Conduct initial threat research based on IOCs collected during investigations.
• Participate in a rotating on-call schedule; ability to work on weekends and outside normal business hours as needed.

Skills

Incident response

Digital forensics

Threat hunting

Endpoint forensics

EDR platforms

Education

GCFE

GCIH

Falcon Administrator certification

Tools

CrowdStrike Falcon

Job description

About the Role

The Consultant is an engagement delivery contributor within CYPFER's DFIR and Post-Breach Recovery practice. Operating at the task execution level, the Consultant works alongside senior practitioners on active incident response and recovery engagements - collecting evidence, executing playbooks, triaging artefacts, and producing client-ready documentation. The role interacts directly with insurance partners, legal counsel, client technical teams, and executives as part of structured engagement delivery. This is a hands-on role suited to early-career cybersecurity professionals building deep technical expertise across DFIR and PBR.

Core Responsibilities

• Understand the client challenge and objective; execute defined tasks in line with engagement scope and the path to recovery.
• Deliver discrete work packages including forensic acquisition, IOC triage, and recovery steps under the direction of senior team members.
• Maintain accurate case notes and produce client-ready artefacts; adhere to SOPs and QA standards throughout all engagements.
• Escalate risks early; follow chain-of-custody and compliance requirements at all times.
• Analyze triage collections and artefacts for indicators of compromise (IoCs) and potentially malicious activity.
• Review logs from host systems and appliances to identify suspicious activities.
• Collect forensic disk and memory images from physical and virtual endpoints and servers.
• Contribute to event correlation and the building of engagement timelines under senior guidance.
• Conduct initial threat research based on IOCs collected during investigations.
• Participate in a rotating on-call schedule; ability to work on weekends and outside normal business hours as needed.

Technical Requirements

• 1-3 years of experience in incident response, digital forensics, or a related cybersecurity role.
• Working knowledge of endpoint forensics - acquire and preserve evidence from physical and virtual systems, and triage artefacts to support investigations; SANS FOR500 (GCFE) certification is an asset.
• Hands-on experience operating EDR platforms (e.g., CrowdStrike Falcon) for threat hunting, host isolation, and telemetry collection; vendor EDR certification (e.g., Falcon Administrator) is an asset.
• Ability to execute DFIR and PBR playbooks accurately under guidance, following structured SOPs from initial triage through to recovery.
• Ability to produce clear, accurate, client-ready case notes and reports throughout an engagement.
• Familiarity with IR orchestration platforms or case management tooling is an asset.

Business Responsibilities

• Exhibit strong customer service and consulting skills in all client interactions.
• Adhere to client and internal policies, procedures, and security practices.
• Remain calm, composed, and articulate in high-pressure client situations.
• Exhibit excellent relationship management and communication skills.
• Ensure a high level of confidentiality due to having access to sensitive client and incident data.

Preferred Skills

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field - or equivalent hands-on experience.
• Industry certifications such as GCFE, GCIH, or similar are a strong asset.
• Familiarity with SIEM and SOAR solutions.
• Exposure to threat hunting, network forensics, or malware analysis methodologies.
• Experience in a professional services or consulting environment
• Industry certifications such as MCFE, ENCE, ACE, GCFA, GCIH, GNFA, GCFE or similar are a plus.

Compensation

• Compensation package includes a base salary, medical benefits and multiple bonus opportunities.

Cypfer is an equal opportunity employer.

If you need accommodation during the interview process or beyond, please let us know.

We celebrate our inclusive work environment and welcome applicants from all backgrounds and perspectives.

We thank you for your interest in joining the Cypfer team! While we welcome all applicants, only those selected for an interview will be contacted.