Principal Network DFIR Engineer

Verizon; Cary (NC); Hybrid; USD 121,000 - 231,000; Full time

Job summary

Verizon is seeking a Principal Engineer to lead DFIR across Core, Edge, and virtual networks. The role demands autonomous incident response leadership, executive-level command during security events, and hands-on analysis of network telemetry and forensics to drive detections and rapid containment.

The successful candidate will architect automated DFIR pipelines, develop playbooks, and deliver comprehensive reports with timelines and remediation guidance.

Qualifications

• Bachelor's degree or 4+ years of relevant work experience.
• Six or more years in digital forensics, network security engineering, or incident response.
• Proven autonomy with zero supervision and complex technical initiatives.
• Deep experience with SIEM/data analysis platforms (Splunk, ELK).
• Strong proficiency with forensic suites such as EnCase, FTK, Volatility, X-Ways, SANS SIFT, KAPE.
• Hands-on experience authoring and operationalizing YARA/YARA-L rules.
• Expert knowledge of TCP/IP, BGP, OSPF, DNS, TLS, HTTP/S and telemetry formats.
• Proficiency in scripting for artifact collection and processing (Python/PowerShell/Bash).

Responsibilities

• Autonomous DFIR leadership across Core, Edge, and virtual networks.
• Executive incident command during major security events with cross-functional coordination.
• Network telemetry analysis using PCAP, NetFlow/IPFIX, and logs.
• Advanced forensics & artifact extraction with YARA rule development.
• Threat hunting and IOC extraction to create detections.
• Automation of DFIR tooling and cloud-native pipelines.
• Develop DFIR playbooks and runbooks for high-impact incidents.
• Produce forensic investigation reports detailing timelines, root cause, and remediation.

Skills

DFIR leadership

Executive incident command

Network telemetry analysis

Forensics & artifact extraction

Threat hunting & IOC extraction

Automation & tooling

Playbooks & runbooks

Executive reporting

Scripting (Python/PowerShell/Bash)

Core network protocols knowledge

Education

Bachelor's degree

6+ years in digital forensics / security

Tools

Splunk

ELK

EnCase

FTK

Volatility

X-Ways

SANS SIFT

KAPE

YARA

YARA-L

Job description

Verizon is seeking a Principal Engineer to lead DFIR across Core, Edge, and virtual networks. The role demands autonomous incident response leadership, executive-level command during security events, and hands-on analysis of network telemetry and forensics to drive detections and rapid containment.

The successful candidate will architect automated DFIR pipelines, develop playbooks, and deliver comprehensive reports with timelines and remediation guidance.