Lead Principal Consultant DFIR – Spiderlabs

Forensic Focus; United States; Hybrid; USD 123,000 - 179,000; Full time

Job summary

Forensic Focus in the United States seeks a Lead Principal Consultant DFIR to lead end-to-end incident response engagements, from identification and containment through forensic examination and recovery, serving as the primary client contact and delivery lead. You will collect evidence, analyze artifacts, review logs, and produce narrative incident reports for diverse audiences.

This role requires strong DFIR expertise, X-Ways proficiency, familiarity with NIST/SANS frameworks, and excellent

Qualifications

• Proven DFIR experience with incident response engagements.
• Familiarity with NIST and SANS frameworks.
• Scripting skills in Python or PowerShell are advantageous.

Responsibilities

• Lead end-to-end incident response engagements from identification to recovery.
• Act as primary client point of contact and delivery lead.
• Collect evidence, analyze artifacts, review logs, and write narrative reports.
• Travel as needed for client engagements.

Skills

DFIR experience

Scripting (Python/PowerShell)

Strong written communication

Education

Digital forensics / incident response certifications

Tools

X-Ways

Job description

# Lead Principal Consultant DFIR – Spiderlabs*LevelBlue***United States**Lead/Principal · Full-time### The RoleThe consultant leads end-to-end incident response engagements — from initial identification and containment through forensic examination and recovery — acting as the primary client point of contact. Day-to-day work spans evidence collection, artifact analysis, log review, and authoring narrative-driven incident reports for diverse audiences.### Skills & ExperienceCandidates should bring proven DFIR experience, proficiency with forensic tooling such as X-Ways, and familiarity with frameworks including NIST and SANS. Scripting skills in Python or PowerShell are advantageous, as are industry certifications in digital forensics or incident response and strong written communication abilities.### Who It SuitsThis role suits an experienced DFIR professional comfortable operating independently on complex, time-sensitive engagements and working directly with client legal, IT, and compliance teams. Those who thrive in a consulting environment with varied casework, on-call responsibilities, and occasional travel will find it a strong fit.Typical advertised salary forIncident Response roles in United States:**$123,000–$179,000**(median $149,000 — from159 recent listings analysed by Forensic Focus).Compare Incident Response salaries in United States →Certifications mentioned:SANS — find training for these on theDFIR Training Finder.Learn More/Apply