Senior Consultant, DFIR, Reactive Services (Unit 42) – Remote

Forensic Focus; Burbank (CA); Remote; USD 120,000 - 180,000; Full time

Job summary

Palo Alto Networks is seeking a Senior Consultant in DFIR (Unit 42) to lead investigations of ransomware, intrusions, and other security incidents. You will analyze endpoint, network, identity and cloud evidence to build timelines and determine attacker activity.

In this role, you will own investigative workstreams, support containment and recovery, and produce technical reports for clients in a fast-paced consulting environment.

Qualifications

• Hands-on enterprise DFIR experience and forensic acquisition.
• Strong log analysis and Windows investigation expertise.
• Familiarity with Linux, macOS or cloud environments.

Responsibilities

• Investigate ransomware, unauthorized access and security incidents.
• Own investigative workstreams and support containment and recovery.
• Produce technical reports for clients.

Skills

DFIR

Windows forensics

Log analysis

Forensic acquisition

Linux/macOS/cloud

Scripting

MITRE ATT&CK

GCFA/GCFE/GCIH

Job description

# Senior Consultant, DFIR, Reactive Services (Unit 42) – Remote*Palo Alto Networks***Burbank, CA**Remote · Senior · Full-time### The RoleThe consultant investigates ransomware, unauthorized access and other security incidents, analysing endpoint, network, identity and cloud evidence to build timelines and determine attacker activity. They own investigative workstreams, support containment and recovery, and produce technical reports for clients.### Skills & ExperienceRequires hands-on enterprise DFIR experience, forensic acquisition and log analysis skills, and Windows investigation expertise, with familiarity in Linux, macOS or cloud. Preferred extras include malware triage, scripting, MITRE ATT&CK knowledge, and certifications such as GCFA, GCFE or GCIH.### Who It SuitsIdeal for an experienced, client-facing DFIR practitioner who enjoys fast-paced consulting engagements, solving complex technical investigations, and collaborating with senior consultants on real-world breach response.