Senior DFIR Incident Response Lead

Booz Allen Hamilton; Illinois; On-site; USD 113,000 - 257,000; Full time

Benefits offered by this job

Health benefits

Tuition assistance

Professional development

Work‑life programs

Job summary

Booz Allen Hamilton is seeking an experienced Incident Response Lead to direct a team of skilled DFIR analysts. You will guide major incident responses, coordinate containment, and provide clear updates to executive stakeholders.

The role emphasizes documentation, thought leadership, and mentorship to teams in the Digital Forensics and Incident Response domain. The ideal candidate has 3+ years in DFIR, strong scripting ability (Python/PowerShell), and deep experience with Windows and non-Windows

Qualifications

• 3+ years of experience with digital forensics or incident response.
• Experience with Windows and non-Windows systems (Mac/Linux) and DFIR toolsets (FTK, EnCase, XWF, Axiom).
• Experience with script-based DFIR tools (Python/PowerShell).
• Experience analyzing logs (firewall, network, IIS, Antivirus, DNS).
• Knowledge of forensic artifacts used to determine attack vectors, lateral movement and exfiltration.
• Ability to correlate events to build a timeline analysis.
• Ability to organize case notes and communicate with clients (verbal/written).
• Ability to prepare detailed technical reports.
• Willingness to work after hours and on-call rotation.
• HS diploma or GED.

Responsibilities

• Lead incident response for major incidents and coordinate containment and resolution.
• Convey status updates to Cybersecurity and Operations leaders, legal, and other stakeholders.
• Develop, maintain, and review incident documentation.
• Provide thought leadership for program improvements and new initiatives.
• Mentor junior team members and foster continuous learning in DFIR.

Skills

Incident response leadership

Stakeholder communication

Mentorship

Timeline analysis

Case notes organization

Technical reporting

Flexibility to work after hours

Education

HS diploma or GED

Bachelor’s degree preferred

Master’s degree a plus

Tools

FTK

EnCase

XWF

Axiom

Python

PowerShell

Job description

Booz Allen Hamilton is seeking an experienced Incident Response Lead to direct a team of skilled DFIR analysts. You will guide major incident responses, coordinate containment, and provide clear updates to executive stakeholders.

The role emphasizes documentation, thought leadership, and mentorship to teams in the Digital Forensics and Incident Response domain. The ideal candidate has 3+ years in DFIR, strong scripting ability (Python/PowerShell), and deep experience with Windows and non-Windows