Senior DFIR Examiner

Soteria - Security Solutions & Advisory; Charleston (SC); Remote; USD 110,000 - 160,000; Full time

Benefits offered by this job

Remote work

Job summary

Soteria - Security Solutions & Advisory is seeking an experienced Incident Response/DFIR professional to work remotely with clients across the United States. You will lead investigations into cyber incidents, triage data, and guide clients through recovery while coordinating resources and mentoring junior staff.

The role requires 5+ years in digital forensics or incident response, strong leadership, and the ability to communicate complex findings to both technical and non-technical audiences.

Qualifications

• 5+ years of digital forensics, incident response, or other relevant experience.
• Experience leading complex engagements including scoping and client interfacing.
• Strong leadership and crisis management skills.
• Experience examining logs and artifacts to detect indicators of compromise.
• Client-facing role requiring clear written reports and presentations.

Responsibilities

• Provide clients with guidance during incident response and recovery.
• Lead and participate in security incident investigations, triaging and data collection.
• Own DFIR processes to improve team capabilities and ensure timely client deliverables.
• Coordinate resources to deliver engagements on time and accurately.
• Identify gaps in capabilities and tooling and address them.
• Document findings and recommend remediation to clients.
• Maintain relationships with clients post-engagement for ongoing remediation support.
• Stay current on security trends and practices and share with the team.
• Collaborate with managed detection and response team to improve detection.
• Mentor other team members to grow company capacity.

Skills

Digital forensics

Incident response

Network security

Team leadership

Crisis management

Communication

Windows forensics

Linux forensics

Scripting

Tools

Axiom

FTK

SIEM

Job description

Established in 2014 and based in Charleston, South Carolina, Soteria's expertise in the cybersecurity domain is predicated upon the accumulated practical experience across all team members. Soteria's security professionals have held leading positions in private industries, state governments, and federal intelligence communities.

Driven by this combined pool of knowledge as well as the belief that “Security is for Everyone,” Soteria offers advisory services and solutions which are significantly differentiated from the security status quo. Soteria treats each client as a unique case deserving of individualized security insights and specialized hands-on assistance.

About The Role

At Soteria, our incident response professionals work directly with our clients to recover from incidents as quickly and effectively as possible. We strive to be the steady hand that guides our clients when they are having their worst day. Once the incident is over, we continue our partnership to assist our customers in implementing the changes needed to prevent repeat incidents in the future.

What You'll Do

• Provide clients with advice and guidance as they navigate the incident response and recovery process.
• Lead and participate in security incident and data breach investigations, triaging, collecting, and analyzing forensically valuable data to determine the scope and severity of incidents.
• Lead IR engagements and take ownership of multiple DFIR processes and procedures to improve overall team capabilities, ensuring timely delivery aligned with client expectations.
• Coordinate resources and teammates as needed to deliver engagements on time and with accuracy, tailoring each engagement to meet the client's specific response needs.
• Identify gaps in capabilities and tooling, and resolve those gaps to ensure the team is able to investigate new and unique threats.
• Document and present findings and recommendations to clients in a professional manner.
• Maintain relationships with clients post-engagement in order to assist and advise on longer-term remediation efforts.
• Maintain competence in security trends, technologies, and practices.
• Work with Soteria's managed detection and response team to improve detection capabilities.
• Identify and train other DART team members, mentoring consultants and analysts to build the company's overall capacity and capability.
• Participate in company-wide initiatives as a DFIR subject matter expert.
• Push the team forward by creating new capabilities to deliver to clients.

Qualifications

• 5+ years of digital forensics, incident response, or other relevant experience.
• Experienced in investigating and understanding techniques related to network breaches, business email compromise (BEC), and ransomware incidents.
• Ability to evaluate triage data and artifacts to detect indicators of compromise (IOCs) and identify suspicious activity.
• Experience leading complicated engagements, including scoping, interfacing with the client, and executing on the technical front; able to push the team forward and create new capabilities to deliver to clients.
• Strong leadership and crisis management skills.
• Strong written and verbal communication skills.
• Working knowledge of Windows, Linux, Unix, and MacOS forensics.
• Proficient in analyzing and interpreting logs from diverse sources.
• Knowledgeable in acquiring and analyzing data from both physical and virtual systems for forensic purposes.
• Familiarity with networking concepts, protocols, and architectures.
• Disk forensics tools such as Axiom, FTK, etc.
• SIEM tools as it relates to searching and extracting relevant data for incident investigations.
• Scripting experience as needed to facilitate investigations and remediation efforts.
• This role is client-facing - must be able to communicate details of findings to both technical and non-technical clients.
• Must be able to deliver detailed written reports at the conclusion of every client engagement.
• Ability to participate in an on-call rotation, with availability for weekend and after-hours work when needed.
• Position is fully remote - no mandatory travel, elective travel to industry conferences and training events.

The Pay Range For This Role Is

110,000 - 160,000 USD per year(Remote)