Remote DFIR Lead: Incident Response & Forensics

Zoho; United States; Remote; USD 140,000 - 210,000; Part time

Job summary

Fyerx is seeking an experienced DFIR Specialist to lead post-breach investigations, containment lifecycles, and digital forensics operations. You will isolate compromised systems, perform disk and memory analyses, reconstruct attack timelines, and preserve legally admissible evidence to help the business recover from advanced cyber incidents.

Required: 5–8 years in cybersecurity with at least 4 years in post-breach assessments; strong command of EnCase, FTK, Volatility, and X-Ways Forensics;

Qualifications

• 5–8 years of core cybersecurity experience, with 4+ dedicated years in post-breach digital forensics.
• Strong mastery of advanced forensic software environments and memory/disk analysis.
• Deep understanding of file systems, logs, and malware persistence mechanics.
• Mandatory GCFA, GCIH, or CCE certifications.

Responsibilities

• Lead high-severity incident response lifecycles across global networks.
• Perform deep digital forensic investigations on live and image data.
• Reconstruct complex threat timelines and C2 patterns.
• Enforce strict chain-of-custody data preservation per standards.
• Analyze malware behavior and translate findings into IOIs and reports.
• Author runbooks and reports for legal and executive stakeholders.
• Collaborate with GRC and legal teams on breach notifications.

Skills

Post-breach investigations

Threat hunting

Evidence preservation

Chain-of-custody

Forensic reporting

Education

GCFA

GCIH

CCE

Tools

EnCase

FTK

Volatility

X-Ways Forensics

Job description

Fyerx is seeking an experienced DFIR Specialist to lead post-breach investigations, containment lifecycles, and digital forensics operations. You will isolate compromised systems, perform disk and memory analyses, reconstruct attack timelines, and preserve legally admissible evidence to help the business recover from advanced cyber incidents.

Required: 5–8 years in cybersecurity with at least 4 years in post-breach assessments; strong command of EnCase, FTK, Volatility, and X-Ways Forensics;