Senior DFIR Incident Response Lead – Remote

Jobs Paloaltonetworks; Burbank (CA); Remote; USD 151,000 - 208,000; Full time

Job summary

Palo Alto Networks is seeking a Principal Consultant, Reactive Services, a senior DFIR expert within Unit 42. You will lead investigations, guide containment, and drive remediation across diverse environments, including Windows, Linux, and macOS.

The role requires 6-8+ years in DFIR, strong analytical and client-facing skills, and a dedication to 24x7 incident response readiness. Remote work with potential travel is offered.

Qualifications

• Bachelor's degree or equivalent practical experience.
• 6-8+ years of experience in DFIR, incident response, security operations, or related cybersecurity disciplines.
• Experience investigating ransomware, intrusion activity, and other enterprise-scale security incidents.
• Strong understanding of forensic acquisition, evidence handling, and investigative methodologies.
• Hands-on experience with DFIR tools such as EnCase, FTK, SleuthKit, Volatility, or equivalent frameworks.
• Experience investigating Windows, Linux, and macOS environments.
• Strong analytical, problem-solving, and client-facing communication skills.

Responsibilities

• Lead digital forensics and incident response investigations across enterprise environments.
• Serve as a technical lead on incident response engagements.
• Conduct host, network, and cloud investigations to identify root cause, attacker activity, and scope of compromise.
• Perform forensic acquisition and analysis of systems, memory, logs, and endpoint telemetry.
• Utilising industry-standard DFIR tools and methodologies to support incident containment and recovery.
• Deliver clear findings and remediation guidance to clients and stakeholders.
• Support development of DFIR playbooks, tools, and investigative methodologies.
• Mentor team members and contribute to knowledge sharing across Unit 42.

Skills

Analytical thinking

Problem solving

Client-facing communication

Education

Bachelor's degree or equivalent practical experience

Tools

EnCase

FTK

SleuthKit

Volatility

Job description

Palo Alto Networks is seeking a Principal Consultant, Reactive Services, a senior DFIR expert within Unit 42. You will lead investigations, guide containment, and drive remediation across diverse environments, including Windows, Linux, and macOS.

The role requires 6-8+ years in DFIR, strong analytical and client-facing skills, and a dedication to 24x7 incident response readiness. Remote work with potential travel is offered.