Senior Cyber DFIR Lead — Incident Response & Forensics

NorthMark Strategies LLC; Dallas (TX); Vor Ort; USD 140.000 - 190.000; Vollzeit

Benefits dieser Stelle

Company-Paid Lunch Stipend

100% Employer-Paid Medical, Dental and

Vision benefits

Paid Parental Leave

401(k) Company match

Paid Time Off 25 days + holidays

Zusammenfassung

NorthMark Strategies LLC is seeking a Cyber Defense DFIR Manager to own incident response and digital forensics across a multi-entity ecosystem. You will lead investigations, maintain incident response plans, and evolve tooling, processes, and playbooks to improve readiness across the organization.

The role demands hands-on forensics across disk, memory, network, cloud, and mobile, plus experience with Microsoft 365/Entra forensics, legal hold, and table-top exercises.

Qualifikationen

• Bachelor’s degree in Computer Science, Information Security, or related field; equivalent experience considered.
• 7+ years in incident response, digital forensics, or security operations with IR plan experience.
• 3+ years of people management or mentoring in IR/forensics.
• Hands-on forensics across disk, memory, network, and cloud data; timeline reconstruction.
• Experience with mobile forensics (iOS/Android).
• Cloud-native forensics across AWS, Azure, and Kubernetes.
• Experience with Microsoft 365/Entra forensics (Purview eDiscovery, Content Search, Graph API).
• Experience producing forensic reports suitable for legal/regulatory use.
• Experience building or maintaining forensic lab infrastructure and chain-of-custody.
• Ability to design/tabletop exercises and drive readiness across multiple entities.
• Experience maturing IR/DFIR functions and cross-entity workflows.
• Knowledge of legal hold/eDiscovery processes across multi-entity environments.
• Proficiency with KQL, Python, or PowerShell; knowledge of Microsoft security ecosystem.
• Familiarity with MITRE ATT&CK and NIST SP 800-61; threat intelligence integration.
• Professional certifications such as GCFE/GCFA/EN CE/GREM/CISSP desirable.

Aufgaben

• Maintain and update the enterprise incident response plan and entity-specific playbooks.
• Mature and operationalize the DFIR function, strengthen tooling and workflows.
• Lead investigations across disk, memory, network, cloud, and mobile evidence.
• Perform Microsoft 365/Entra forensics investigations and evidence collection.
• Produce clear forensic reports for legal, regulatory, and potential litigation needs.
• Develop and manage the DFIR lab, including write-blockers and secure storage.
• Oversee legal hold/eDiscovery processes across multiple entities.
• Serve as incident commander or deputy for significant incidents and post-incident reviews.
• Design and run tabletop exercises; manage exercise calendar and after-action reports.
• Collaborate with cross-entity leadership to standardize incident readiness.
• Partner with SIEM/detection engineering to ensure smooth handoff from detection to response.
• Evaluate AI/automation to accelerate triage and timeline reconstruction.

Kenntnisse

Incident response

Digital forensics

Team leadership

Table top exercises

Cloud forensics

Microsoft 365/Entra forensics

Regulatory/compliance reporting

Python/PowerShell

Forensic lab/infrastructure

Threat intelligence integration

Ausbildung

Bachelor’s degree in Computer Science or Information Security

Tools

Magnet AXIOM

Magnet Nexus

X-Ways Forensics

Magnet Verakey

Jobbeschreibung

NorthMark Strategies LLC is seeking a Cyber Defense DFIR Manager to own incident response and digital forensics across a multi-entity ecosystem. You will lead investigations, maintain incident response plans, and evolve tooling, processes, and playbooks to improve readiness across the organization.

The role demands hands-on forensics across disk, memory, network, cloud, and mobile, plus experience with Microsoft 365/Entra forensics, legal hold, and table-top exercises.