Principal Incident Response & Forensics Consultant

Google Inc.; New York (NY); On-site; USD 168,000 - 243,000; Full time

Job summary

As an Incident Response Consultant at Mandiant, part of Google Cloud, you will lead industry-leading investigations, threat-hunting operations, and incident response transformations across cloud and on‑prem environments.

You will own outcomes, guide complex engagements, and communicate findings to executives, legal counsel, and clients. Proficiency with XWays/TSK and quick learning of new stacks are essential; travel up to 30% is expected.

Qualifications

• Bachelor's degree in CS/IS/Cybersecurity or equivalent practical experience.
• 8 years of end-to-end incident response investigations, analysis, or containment actions.
• 8 years of investigative experience with network forensics, malware triage, cloud forensics, or disk/memory forensics.
• Ability to travel up to 30%.

Responsibilities

• Manage incident response engagements, compromise assessments, and threat-hunting operations with minimal guidance.
• Execute digital forensics, host-based live response, network traffic analysis, and static/dynamic malware analysis across cloud (GCP) and on-premise environments.
• Automate forensic tasks and build team utility tools using programming languages.
• Oversee the project lifecycle for multiple consulting engagements, including planning, budgeting, and quality control.
• Draft investigation reports and present technical findings clearly to client stakeholders, leadership, and external legal counsel.

Skills

Incident response

Decision making

Stakeholder influence

Communication with leadership

Cloud and on-prem environments

Education

Bachelor's degree in CS/IS/Cybersecurity or equivalent

Tools

XWays

TSK

Job description

As an Incident Response Consultant at Mandiant, part of Google Cloud, you will lead industry-leading investigations, threat-hunting operations, and incident response transformations across cloud and on‑prem environments.

You will own outcomes, guide complex engagements, and communicate findings to executives, legal counsel, and clients. Proficiency with XWays/TSK and quick learning of new stacks are essential; travel up to 30% is expected.