Principal DFIR Consultant — Remote

Remote; San Francisco (CA); Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Equity

Generous PTO

Medical/Dental/Vision

401K matching

FSA/HSA

Parental leave

Professional development

Job summary

Surefire Cyber is seeking a Principal Consultant in Digital Forensics & Incident Response to lead high-stakes engagements remotely in the USA. You will detect, analyze, and guide remediation of complex cyber incidents, including ransomware and email compromise, while mentoring a team of 3–4 consultants.

You will collaborate with clients and internal teams to refine incident response processes, develop best practices, and provide after-hours support as needed, ensuring rapid, high-quality

Qualifications

• Seasoned cybersecurity professional with extensive DFIR experience.
• Proven track record managing investigations of varying sizes.
• Strong mentoring and communication skills.

Responsibilities

• Lead DFIR engagements for clients across industries.
• Detect and analyze intrusions with guidance to clients.
• Provide after-hours support during incidents.
• Mentor Forensic team of 3-4 consultants.
• Document incident findings with supporting evidence.
• Develop and refine incident response processes.
• Stay current with latest forensic tools and techniques.
• Communicate complex findings to technical and non-technical stakeholders.

Skills

DFIR expertise

Client-facing

Forensic analysis

Incident response leadership

Mentoring

Communication skills

Education

Cybersecurity degree

IT degree

Industry certifications

Tools

ELK

Axiom

Encase

FTK

Open-source tools

Job description

Surefire Cyber is seeking a Principal Consultant in Digital Forensics & Incident Response to lead high-stakes engagements remotely in the USA. You will detect, analyze, and guide remediation of complex cyber incidents, including ransomware and email compromise, while mentoring a team of 3–4 consultants.

You will collaborate with clients and internal teams to refine incident response processes, develop best practices, and provide after-hours support as needed, ensuring rapid, high-quality