Senior DFIR Incident Commander — Remote

BlueVoyant; United States; Remote; USD 150,000 - 210,000; Full time

Job summary

BlueVoyant is seeking an Incident Commander to lead high-impact cyber investigations within Digital Forensics & Incident Response. This senior, client-facing role commands complex incidents from initial response through containment and recovery, advising executives, legal counsel and technical teams.

You will guide investigations across ransomware and cloud/identity compromises, perform endpoint/cloud forensics, and translate findings into business risk and remediation guidance, while briefing

Qualifications

• 3–5 years of hands-on DFIR experience in real-world incidents.
• 6–10 years in client-facing consulting, incident response or cyber advisory roles.
• Proven experience as an incident commander or senior DFIR lead.
• Strong background in ransomware, cloud/identity compromise and complex attack investigations.
• Experience working directly with executives, legal counsel, insurers and technical teams.
• Ability to manage multiple stakeholders, workstreams and timelines under pressure.
• Strong knowledge across endpoint, cloud, identity, SaaS and network forensics.
• Experience with tools such as EnCase, FTK, Magnet AXIOM, Velociraptor, Splunk, Sentinel and CrowdStrike (or similar).
• Familiarity with Microsoft 365, Entra ID, Azure, AWS, Okta and Google Workspace.
• Understanding of attacker tradecraft, including persistence, lateral movement and data exfiltration.
• Working knowledge of KQL, SPL, SQL, PowerShell, Python or Bash.
• Exceptional communication skills, with the ability to translate technical issues into business impact.
• Strong judgment and composure in high-stress, ambiguous environments.
• A collaborative, client-focused approach with a focus on quality and outcomes.

Responsibilities

• Act as incident commander for complex DFIR engagements end-to-end.
• Serve as the primary client lead, advising executives, legal counsel, insurers and stakeholders.
• Lead investigations across ransomware, BEC, cloud/identity compromise, insider threat and advanced attacks.
• Perform and direct forensic analysis across endpoints, cloud, identity, SaaS, email and network environments.
• Translate technical findings into clear business risk and remediation guidance.
• Lead executive briefings, client updates and post-incident reviews.
• Manage multiple concurrent incidents in fast-paced, high-pressure environments.
• Coordinate the work of DFIR consultants and analysts assigned to an engagement, and share expertise through informal coaching and knowledge sharing.
• Support incident readiness, tabletop exercises and client growth initiatives.

Skills

DFIR

Incident command

Client-facing

Executive liaison

Forensic analysis

Threat investigations

Communication

Stakeholder management

High-stress decisions

Team coaching

Education

Bachelor’s degree preferred

Tools

EnCase

FTK

Magnet AXIOM

Velociraptor

Splunk

CrowdStrike

Microsoft 365

Entra ID

Azure

AWS

Okta

Google Workspace

Job description

BlueVoyant is seeking an Incident Commander to lead high-impact cyber investigations within Digital Forensics & Incident Response. This senior, client-facing role commands complex incidents from initial response through containment and recovery, advising executives, legal counsel and technical teams.

You will guide investigations across ransomware and cloud/identity compromises, perform endpoint/cloud forensics, and translate findings into business risk and remediation guidance, while briefing