Digital Forensics & Incident Response (DFIR) Director

IronGate Cybersecurity LLC; United States; On-site; USD 180,000 - 240,000; Full time

Job summary

IronGate Cybersecurity LLC is seeking a seasoned DFIR Director to lead incident response investigations across ransomware, data breach, cloud compromise, and insider threats. You will steer engagements from scoping to containment, coordinating with counsel, insurers, and executives while maintaining investigative rigor and business impact awareness.

The role requires deep DFIR expertise, strong executive communication, and proven leadership in a consulting or professional services setting.

Qualifications

• Minimum 6+ years of Digital Forensics and Incident Response experience.
• Proven leadership of ransomware and/or cyber extortion investigations across incident stages.
• Experience coordinating with legal counsel and cyber insurance stakeholders during incidents.
• Strong executive communication and business acumen in client-facing engagements.

Responsibilities

• Lead ransomware, cloud, and BEC engagements from intake to closure with strategic direction.
• Serve as senior client contact, briefing executives and coordinating with breach counsel and insurers.
• Develop defensible investigative plans, staffing models, budgets, and timelines for multiple engagements.
• Oversee forensics and IR workstreams to ensure evidence preservation while enabling business recovery.
• Mentor analysts and consultants, fostering collaboration and quality control.

Skills

DFIR leadership

Executive communication

Ransomware investigations

Client advisory

Mentorship

Budget & scoping

Team management

Tools

FTK

EnCase

X-Ways

KAPE

Velociraptor

Volatility

Job description

We are seeking a seasoned and strategic DFIR Director to join our Digital Forensics and Incident Response (DFIR) practice. This leadership role is responsible for directing ransomware, cyber extortion, business email compromise (BEC), data breach, cloud compromise, insider threat, and other digital forensic investigations from initial scoping through containment, recovery, reporting, and engagement closure.

The Director will serve as a senior engagement leader and trusted advisor to clients, breach counsel, cyber insurance carriers, brokers, and executive stakeholders during time-sensitive incidents. The ideal candidate combines deep technical DFIR expertise with strong executive communication, sound investigative judgment, commercial awareness, and demonstrated experience leading ransomware matters in a consulting or professional services environment.

About IronGate Cybersecurity:

IronGate Cybersecurity is a leader in providing innovative cybersecurity solutions, protecting organizations from sophisticated cyber threats. With a team of dedicated professionals, we offer comprehensive security assessments, incident response services, and proactive cyber resilience strategies. We are on a quest to defend our clients against the dynamic cyber threat landscape and are looking for motivated individuals to join our journey.

Key Responsibilities:

Ransomware Response

• Lead multiple types of incident response investigations, including ransomware, cloud, and business email compromise engagements, from intake and scoping through investigation, containment, recovery coordination, reporting, and closure.
• Lead and manage a high volume of matters simultaneously.
• Direct investigations involving encryption events, data theft, double-extortion activity, threat-actor persistence, credential compromise, lateral movement, and related post-compromise activity.
• Guide investigative strategy to determine initial access, root cause, scope of compromise, affected systems and accounts, threat-actor activity, persistence, and potential data exfiltration.
• Coordinate forensic investigation and recovery workstreams so that business restoration progresses without unnecessarily compromising evidence preservation or investigative objectives.
• Assess available telemetry, identify collection and retention gaps, and direct supplemental collection or monitoring when endpoint, network, identity, cloud, or other security telemetry is incomplete.
• Translate threat-actor tactics, techniques, procedures, indicators, and investigative findings into practical containment, remediation, recovery, and risk-reduction actions.

Engagement Leadership & Client Advisory

• Serve as the senior point of contact for clients, breach counsel, and executive stakeholders during active matters.
• Lead incident kickoff calls, recurring status calls, executive briefings, technical working sessions, and final readouts.
• Cleary communicate what is known, what remains under investigation, investigative limitations, and the risks associated with reducing or ending investigative scope before material questions are resolved.
• Translate complex forensic findings into concise business, legal, operational, and risk considerations appropriate to the audience.
• Maintain composure, empathy, neutrality, and sound judgment while advising clients during high-pressure and potentially business-disruptive incidents.

Scoping, Budget & Case Management

• Lead inbound scoping calls and rapidly develop defensible investigative plans, staffing models, workstreams, assumptions, budgets, and timelines.
• Manage multiple concurrent engagements in a high-volume professional services environment.
• Maintain accurate case documentation, timekeeping, engagement records, and status information.

Technical Forensics & Incident Response

• Evaluate EDR, SIEM, firewall, VPN, identity, cloud, email, DNS, proxy, and other relevant logs to reconstruct threat actor activity and determine incident scope.
• Oversee analysis of artifacts relevant to execution, persistence, credential access, privilege escalation, lateral movement, staging, archive creation, exfiltration, and ransomware deployment
• Remain current on ransomware groups, emerging threat actor tradecraft, cloud and identity compromise patterns, and evolving investigative techniques.
• Lead, mentor, and develop analysts, consultants, and managing consultants assigned to DFIR matters.
• Coach team members through novel or unfamiliar incidents and foster a collaborative environment where investigative approaches and technical conclusions are actively reviewed.
• Help develop and improve ransomware response playbooks, incident intake processes, evidence collection workflows, reporting standards, quality control procedures and other repeatable operational practices.

Qualifications:

Required Experience:

• Minimum 6+ years of experience in Digital Forensics and Incident Response.
• Demonstrated experience leading ransomware and/or cyber extortion investigations through multiple phases of the incident response lifecycle.
• Experience working directly with legal counsel and/or cyber insurance stakeholders during incident response matters.
• At least 1 year of experience in a leadership or mentorship role within a DFIR team.
• Proven experience managing client relationships and leading technical teams.

Technical Skills:

• Experience with commercial and open source forensic and incident response tooling. Relevant tools may include FTK, EnCase, X-Ways, KAPE, Eric Zimmerman’s tools, Velociraptor, Volatility, and comparable collection, triage, analysis, or threat hunting platforms.
• Experience using or investigating telemetry from enterprise EDR platforms such as Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, or comparable technologies.
• Working knowledge of cloud incident response and investigations involving Microsoft Azure, AWS, GCP, SaaS platforms or hybrid environments is strongly preferred.
• Ability to identify and interpret forensic artifacts supporting findings related to program execution, persistence, user activity, credential access, lateral movement, staging, exfiltration and other attacker activity.

Certifications (Preferred):

• CFCE – Certified Forensic Computer Examiner
• GCFA – GIAC Certified Forensic Analyst
• GCFE – GIAC Certified Forensic Examiner
• GNFA – GIAC Network Forensic Analyst

Key Attributes:

• Strong leadership and communication skills.
• Ability to manage multiple priorities in a fast-paced environment.
• High attention to detail and commitment to quality.
• Client-focused with a consultative approach.

IronGate Cybersecurity is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment based on individual merit, skills, and performance, without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristics protected by law. IronGate Cybersecurity is committed to providing a workplace environment free from discrimination and ensuring equal opportunity for all employees.