Hands-On DFIR & Forensics Incident Response Consultant

Cypfer; United States; Sur place; USD 70 000 - 110 000; Plein temps

Résumé du poste

Cypfer is seeking a Consultant to join its DFIR and Post-Breach Recovery practice in the United States. The role is hands-on and involves working with insurance partners, legal counsel, client technical teams, and executives to deliver structured incident response and recovery engagements.

You'll perform evidence collection, playbook execution, IOC triage, and client-ready documentation, with opportunities to contribute to timelines, threat research, and on-call rotation, including occasional

Qualifications

• 1-3 years of experience in incident response, digital forensics, or a related cybersecurity role.
• Working knowledge of endpoint forensics - acquire and preserve evidence from physical and virtual systems, and triage artefacts to support investigations; SANS FOR500 (GCFE) certification is an asset.
• Hands-on experience operating EDR platforms (e.g., CrowdStrike Falcon) for threat hunting, host isolation, and telemetry collection; vendor EDR certification (e.g., Falcon Administrator) is an asset.
• Ability to execute DFIR and PBR playbooks accurately under guidance, following structured SOPs from initial triage through to recovery.
• Ability to produce clear, accurate, client-ready case notes and reports throughout an engagement.
• Familiarity with IR orchestration platforms or case management tooling is an asset.

Responsabilités

• Understand the client challenge and objective; execute defined tasks in line with engagement scope and the path to recovery.
• Deliver discrete work packages including forensic acquisition, IOC triage, and recovery steps under the direction of senior team members.
• Maintain accurate case notes and produce client-ready artefacts; adhere to SOPs and QA standards throughout all engagements.
• Escalate risks early; follow chain-of-custody and compliance requirements at all times.
• Analyze triage collections and artefacts for indicators of compromise (IoCs) and potentially malicious activity.
• Review logs from host systems and appliances to identify suspicious activities.
• Collect forensic disk and memory images from physical and virtual endpoints and servers.
• Contribute to event correlation and the building of engagement timelines under senior guidance.
• Conduct initial threat research based on IOCs collected during investigations.
• Participate in a rotating on-call schedule; ability to work on weekends and outside normal business hours as needed.

Connaissances

Incident response

Digital forensics

Threat hunting

Endpoint forensics

EDR platforms

Formation

GCFE

GCIH

Falcon Administrator certification

Outils

CrowdStrike Falcon

Description du poste

Cypfer is seeking a Consultant to join its DFIR and Post-Breach Recovery practice in the United States. The role is hands-on and involves working with insurance partners, legal counsel, client technical teams, and executives to deliver structured incident response and recovery engagements.

You'll perform evidence collection, playbook execution, IOC triage, and client-ready documentation, with opportunities to contribute to timelines, threat research, and on-call rotation, including occasional