Senior Cloud DFIR Lead - Remote Incident Response

Palo Alto Networks, Inc.; Arizona; Remote; USD 151,000 - 208,000; Full time

Job summary

Palo Alto Networks is seeking a Principal Consultant, Cloud DFIR, Reactive Services to lead cloud-focused incident response and digital forensics investigations across AWS, Azure, GCP, and hybrid environments.

You will serve as a technical lead on active incidents, guiding remediation and client communications, with responsibility for advanced cloud forensic analysis and actionable recommendations.

Qualifications

• 6–8+ years in DFIR, incident response, cloud security, or related cybersecurity disciplines.
• 3+ years hands-on experience securing, operating, or investigating AWS, Azure, or GCP environments.
• Experience leading investigations involving cloud breaches, ransomware, advanced intrusions, or data compromise incidents.
• Strong understanding of cloud architecture, IAM, networking, logging, and security controls.
• Experience analyzing cloud-native telemetry such as AWS CloudTrail, Azure Activity Logs, Microsoft Entra ID, or Google Cloud Audit Logs.
• Hands-on experience with industry-standard DFIR and investigative tools.
• Experience investigating Windows, Linux, macOS, cloud workloads, and hybrid environments.
• Strong client-facing communication and consulting skills.

Responsibilities

• Lead cloud-focused incident response and digital forensics engagements.
• Investigate attacks involving cloud infrastructure, identity compromise, ransomware, data theft, and unauthorized access.
• Analyze cloud telemetry, including audit logs, IAM activity, network traffic, storage access, containers, and endpoint data.
• Conduct forensic acquisition and analysis across cloud, hybrid, and enterprise environments.
• Serve as a technical lead during active investigations, guiding strategy and client communications.
• Deliver clear findings, executive-ready reporting, and remediation guidance.
• Support development of cloud investigation methodologies, playbooks, and tooling.
• Mentor team members and contribute to knowledge sharing across Unit 42.

Skills

DFIR

Incident response

Cloud security

Cybersecurity

Client-facing communication

Cloud telemetry

Education

GCFA

GCIH

CISSP

AWS Security Specialty

Azure Security Engineer

Tools

AWS CloudTrail

Azure Activity Logs

Google Cloud Audit Logs

Microsoft Entra ID

Job description

Palo Alto Networks is seeking a Principal Consultant, Cloud DFIR, Reactive Services to lead cloud-focused incident response and digital forensics investigations across AWS, Azure, GCP, and hybrid environments.

You will serve as a technical lead on active incidents, guiding remediation and client communications, with responsibility for advanced cloud forensic analysis and actionable recommendations.