Remote DFIR Analyst — Incident Response & Forensics Expert

Frsecure Llc; Charlotte (NC); Remote; USD 95,000 - 125,000; Full time

Benefits offered by this job

Flexible work environment

Meaningful, mission-driven work

Mental health & wellbeing support

Growth & development

Comprehensive benefits

Generous time off

Job summary

FRSecure is seeking a DFIR Analyst to support clients in detecting, containing, and remediating cyber incidents. The role blends proactive project work with hands-on incident response, including tabletop exercises and coaching engagements.

You will operate remotely within a defined set of US states, with on-call duties and travel minimal. A strong background in information security and experience with AD/M365 is required or preferred.

Qualifications

• 3-5 years of information security experience.
• 3-5 years of experience with AD, systems, Exchange, and cloud environments.
• 3-5 years of presenting information security concepts.

Responsibilities

• Perform forensic reviews for artifacts and IOCs to contain malware and intruders.
• Conduct triage, threat-hunting, and case management for IR clients.
• Document evidence, findings, and reports for clients.
• Meet with clients during planning and information sharing stages.
• Create and deliver proactive projects including tabletop exercises and plan coaching.
• Attend regular client calls to discuss IR programs.
• Stay updated on cyber forensics and attack methodologies.

Skills

Incident response

Threat hunting

EDR management

SIEM

Networks security

Communication skills

Project management

Education

GCFA

GCIH

ECIH

Tools

Active Directory

M365

Exchange Admin

Job description

FRSecure is seeking a DFIR Analyst to support clients in detecting, containing, and remediating cyber incidents. The role blends proactive project work with hands-on incident response, including tabletop exercises and coaching engagements.

You will operate remotely within a defined set of US states, with on-call duties and travel minimal. A strong background in information security and experience with AD/M365 is required or preferred.