Hybrid DFIR Incident Response Lead

LevelBlue, LLC.; New York (NY); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) with employer match

Paid time off and holidays

Health savings accounts / Flexible SP

Employee assistance programs

Training and development opportunities

Adoption assistance

Job summary

LevelBlue seeks a Digital Forensics and Incident Response (DFIR) Specialist to join our Global DFIR team. You will investigate incidents, lead responses, analyze evidence from servers, endpoints, and cloud platforms, and serve as the primary client contact to drive containment and recovery.

You will produce clear incident reports, work with cross-functional teams, and balance multiple engagements, travel as needed, and uphold regulatory requirements.

Qualifications

• Proven experience in DFIR.
• Strong knowledge of digital forensics tools and techniques, including X-Ways, or similar forensic tooling.
• Experience with incident response frameworks and methodologies, such as NIST or SANS.
• Excellent analytical and problem-solving skills.
• Strong understanding of network protocols, operating systems, and security technologies.
• Excellent written and verbal communication skills.
• Experience and interest in interfacing with clients or customers.
• Ability to work independently and manage multiple projects simultaneously.
• Flexibility to support travel and on-call schedule as required.

Responsibilities

• Lead and coordinate responses to cybersecurity incidents for clients.
• Analyse security breaches to determine root cause and impact.
• Conduct forensic investigations on servers, workstations, networks, and SaaS platforms.
• Collect, preserve, and analyse digital evidence per legal/regulatory requirements.
• Prepare detailed incident reports with narratives for non-technical audiences.
• Maintain thorough documentation of all incident response activities.
• Collaborate with DFIR, Advisory, Testing, Threat Intelligence, and MDR/MSS teams.
• Engage with client IT, legal, compliance and external vendors as primary contact.
• Communicate updates to stakeholders and align with incident response processes.

Skills

DFIR

Digital forensics

Incident response

Client communication

Python/PowerShell scripting

Networking concepts

Education

Bachelor's or Master's in Digital Forensics / CS

DFIR certifications

Tools

X-Ways

Forensic tooling

NIST/SANS frameworks

Job description

LevelBlue seeks a Digital Forensics and Incident Response (DFIR) Specialist to join our Global DFIR team. You will investigate incidents, lead responses, analyze evidence from servers, endpoints, and cloud platforms, and serve as the primary client contact to drive containment and recovery.

You will produce clear incident reports, work with cross-functional teams, and balance multiple engagements, travel as needed, and uphold regulatory requirements.