Incident Commander, Digital Forensics & Incident Response

BlueVoyant; United States; Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Competitive compensation

Comprehensive benefits package

Wellbeing and career development

Job summary

BlueVoyant is actively seeking an Incident Commander within Digital Forensics & Incident Response. You will lead high-impact cyber investigations, guide organizations from initial response through containment and recovery, and advise executives, legal counsel, insurers and technical teams.

You will coordinate DFIR consultants, manage multiple incidents, and contribute to readiness and tabletop exercises. A senior, client-facing contributor role emphasizes clear business risk translation and

Qualifications

• 3–5 years hands-on DFIR experience in real-world incidents.
• 6–10 years in client-facing consulting, incident response or cyber advisory roles.
• Proven experience as an incident commander or senior DFIR lead.
• Strong background in ransomware, cloud/identity compromise and complex attack investigations.
• Experience with executives, legal counsel, insurers and technical teams.

Responsibilities

• Act as incident commander for complex DFIR engagements end-to-end.
• Lead investigations across ransomware, cloud/identity compromise and advanced attacks.
• Perform and direct forensic analysis across endpoints, cloud, identity, SaaS, email and network.
• Translate technical findings into business risk and remediation guidance.
• Lead executive briefings, client updates and post-incident reviews.

Skills

DFIR experience

Client-facing

Executive communication

Incident commander

Stakeholder management

Forensics across endpoints/cloud

Cloud forensics

Scripting: PowerShell/Python

KQL/SPL/SQL

Threat and risk translation

Education

Bachelor's degree in Cybersecurity/CS/DFIR or related field

Tools

EnCase

FTK

Magnet AXIOM

Velociraptor

Splunk

Sentinel

CrowdStrike

Job description

Position: Incident Commander
Reports To: Head of Digital Forensics & Incident Response
Department: Digital Forensics & Incident Response
Location: Remote, US
Work Authorization: US Citizenship Required

BlueVoyant is seeking an Incident Commander, Digital Forensics & Incident Response to lead high-impact cyber investigations and take command of complex, high-pressure security incidents. This is a senior, client-facing individual contributor role with no direct reports. You'll guide organizations through critical moments, from initial response through investigation, containment and recovery, while advising executives, legal counsel and technical teams.

What You'll Do:

• Act as incident commander for complex DFIR engagements end-to-end.
• Serve as the primary client lead, advising executives, legal counsel, insurers and stakeholders.
• Lead investigations across ransomware, BEC, cloud/identity compromise, insider threat and advanced attacks.
• Perform and direct forensic analysis across endpoints, cloud, identity, SaaS, email and network environments.
• Translate technical findings into clear business risk and remediation guidance.
• Lead executive briefings, client updates and post-incident reviews.
• Manage multiple concurrent incidents in fast-paced, high-pressure environments.
• Coordinate the work of DFIR consultants and analysts assigned to an engagement, and share expertise through informal coaching and knowledge sharing.
• Support incident readiness, tabletop exercises and client growth initiatives.

What You'll Bring:

• 3–5 years of hands-on DFIR experience in real-world incidents.
• 6–10 years in client-facing consulting, incident response or cyber advisory roles.
• Proven experience as an incident commander or senior DFIR lead.
• Strong background in ransomware, cloud/identity compromise and complex attack investigations.
• Experience working directly with executives, legal counsel, insurers and technical teams.
• Ability to manage multiple stakeholders, workstreams and timelines under pressure.
• Strong knowledge across endpoint, cloud, identity, SaaS and network forensics.
• Experience with tools such as EnCase, FTK, Magnet AXIOM, Velociraptor, Splunk, Sentinel and CrowdStrike (or similar).
• Familiarity with Microsoft 365, Entra ID, Azure, AWS, Okta and Google Workspace.
• Understanding of attacker tradecraft, including persistence, lateral movement and data exfiltration.
• Working knowledge of KQL, SPL, SQL, PowerShell, Python or Bash.
• Exceptional communication skills, with the ability to translate technical issues into business impact.
• Strong judgment and composure in high-stress, ambiguous environments.
• A collaborative, client-focused approach with a focus on quality and outcomes.

Nice to Have:

• Experience working with breach counsel, insurers or regulators.
• Incident readiness, tabletop or IR planning experience.
• Certifications such as CISSP, GCFA, GCIH, GCFE, GNFA, OSCP.

Education:

• Bachelor's degree preferred (Cybersecurity, Computer Science, DFIR or a related field), or equivalent professional experience.

Why BlueVoyant?

• Take command of high-impact, global cyber investigations, guiding clients through critical, business-defining incidents.
• Work alongside experienced DFIR experts, including former government cyber professionals and industry veterans, across complex environments and advanced threat scenarios.
• Join a global, mission-driven cybersecurity company defending organizations worldwide with cutting-edge data, technology, and expertise.
• Competitive compensation and a comprehensive benefits package, with support for wellbeing, development, and career growth.

About BlueVoyant

BlueVoyantis an AI-driven cybersecurity company dedicated to standing between our customers and cyber threats. By combining human,artificial,and proprietary intelligence, we deliver a unified solution that protects every organization’s network, identities, vendors, and digitalfootprintsas a single attack surface. The company’s award-winning Microsoft Securityexpertisehelps organizations maximize their security investments while reducing risk and ensuring compliance.

Led by CEO, John Hernandez,BlueVoyant’shighly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency, Federal Bureau of Investigation, Unit 8200, and GCHQ, together with private sector experts.BlueVoyantservicesutilizelarge real-time datasets with industry leading analytics and technologies.

Founded in 2017 by Fortune 500 executives, including Chairman of the Board, Jim Rosenthal, Vice Chairman, Tom Glocer, and former Government cyber officials,BlueVoyantis headquartered in New York City and has offices in Maryland, Tel Aviv, San Francisco, London, Budapest, and Latin Americaand is committed to building a workplace where talented people are empowered to do their best work in the fight against global cyber threats..

All employees mustbe authorized towork in the United States of America. BlueVoyantprovidesequal employment opportunities to all employees and applicants for employment without regard to race,color, religion, sex, national origin, age, disability, or genetics. In addition to federal law requirements,BlueVoyantcomplies withapplicable state and local laws governing non-discrimination in employment in every location in which the company has facilities.

Disclaimer:

Please note that pursuant to contractual requirements and applicable law,for employees to perform work on some of the company’s federal contracts, U.S. citizenship is required. Accordingly, an employee’s ability to perform work on such contracts is contingent upon the company’s verification of the employee’s citizenship status.

Important Information for Applicants:

BlueVoyant uses AI-assisted tools within our applicant tracking system to help identify candidates whose experience and skills best match the requirements of a role. This technology provides hiring teams with added insights to support fair and efficient hiring decisions. All applications are reviewed by a member of our hiring team, and final hiring decisions are made by humans, not AI. By submitting your application, you acknowledge that AI tools may assist in the evaluation of your resume as part of the recruitment process.

Interview Expectations:

As part of our interview process, we assess your experience through real-time discussion, so we expect responses to be your own. While we embrace the use of AI within our business and recruitment process, we do not permit its use during interviews. Any suspected use of AI during an interview will be challenged, and this may include the use of detection tools.

BlueVoyant Candidate Privacy Notice:

To understand how we secure and manage your personal data upon submitting a job application, please see our Candidate Privacy Notice, which can be found here - Candidate Privacy Notice