Senior DFIR Consultant: Incident Response & Forensics Lead

Cypfer; Oregon; Hybrid; USD 120,000 - 160,000; Full time

Job summary

Cypfer is seeking a Senior Consultant to lead small incident response workstreams, coordinate consultants, and ensure deliverable quality aligned with client objectives. The role involves hands-on DFIR tasks across insurance, legal, and enterprise engagements, with travel required up to 50% and remote work flexibility.

The ideal candidate has 3–5+ years in incident response/forensics, strong DFIR capabilities, and proficiency in Python/PowerShell scripting.

Qualifications

• 3–5+ years in incident response, forensics, or related cybersecurity role.
• GCFA/GCFR and DFIR experience is preferred.
• Strong ability to coordinate plans and risks across a workstream.
• Experience presenting interim findings and delivering client-ready artifacts.
• Basic scripting in Python and/or PowerShell.

Responsibilities

• Lead small workstreams; coordinate tasks to meet client objectives.
• Own workstream planning, stand-ups, and risk tracking.
• Validate technical outputs; present interim findings to client stakeholders.
• Collect and analyze IoCs and review logs across endpoints and servers.
• Perform forensic acquisitions and timeline construction.
• Maintain case notes and deliver client-ready artefacts; follow SOPs/QA.
• Travel to client sites on short notice; on-call as needed.

Skills

Incident response

Digital forensics

Threat hunting

Scripting (Python/PowerShell)

Communication

Coordination

Education

Bachelor's degree in Cybersecurity, Computer Science, IT, or related field

GCFA/GCFR/GCIH/CCFR/CCHF certifications

Tools

CrowdStrike Falcon

Job description

Cypfer is seeking a Senior Consultant to lead small incident response workstreams, coordinate consultants, and ensure deliverable quality aligned with client objectives. The role involves hands-on DFIR tasks across insurance, legal, and enterprise engagements, with travel required up to 50% and remote work flexibility.

The ideal candidate has 3–5+ years in incident response/forensics, strong DFIR capabilities, and proficiency in Python/PowerShell scripting.