Principal Consultant: DFIR (Fully Remote)

Cyderes; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Cyderes is seeking a senior security incident response lead to manage the full lifecycle of sensitive customer incidents. You will act as the primary interface during crises, coordinating communications and rapid containment.

The role requires extensive IR experience, knowledge of MITRE ATT&CK, and hands-on expertise with Python, PowerShell, Elasticsearch, and SIEMs. You will train junior responders and help enhance Cyderes IR services.

Qualifications

• Minimum 5 years in information security with 3+ years in incident response and relevant certifications.
• Strong knowledge of the Incident Response Lifecycle, Cyber Kill Chain, and MITRE ATT&CK.
• Experience with Python, PowerShell, Elasticsearch, SIEMs, and endpoint forensic tools is a plus.

Responsibilities

• Act as the lead responder for sensitive customer security incidents, managing the full response lifecycle.
• Serve as a primary interface during crises, ensuring clear communication and efficient incident handling.
• Perform incident triage, scoping, and forensic analysis using industry standard tools.
• Investigate endpoint, memory, network, and cloud evidence to identify threats and indicators of compromise.
• Train, develop, and supervise junior and ad-hoc responders while improving Cyderes IR services.

Skills

Incident response

Cybersecurity

Leadership

Tools

Python

PowerShell

Elasticsearch

SIEMs

Endpoint forensics

Job description

• Act as the lead responder for sensitive customer security incidents, managing the full response lifecycle.
• Serve as a primary interface during crises, ensuring clear communication and efficient incident handling.

Key Responsibilities:

• Perform incident triage, scoping, and forensic analysis using industry standard tools.
• Investigate endpoint, memory, network, and cloud evidence to identify threats and indicators of compromise.
• Train, develop, and supervise junior and ad-hoc responders while improving Cyderes IR services.

Requirements & Assets:

• Minimum 5 years in information security with 3+ years in incident response and relevant certifications.
• Strong knowledge of the Incident Response Lifecycle, Cyber Kill Chain, and MITRE ATT&CK.
• Experience with Python, PowerShell, Elasticsearch, SIEMs, and endpoint forensic tools is a plus.

Cyderes builds practical identity and access management, exposure management, and risk programs, helping organizations stop active threats fast with managed detection and response. A Great Place to Work-Certified global team, they are driven by experienced operators and augmented by AI to deliver trusted security solutions.