Senior DFIR Incident Response Lead (Remote)

Cypfer; Phoenix (AZ); Remote; USD 120,000 - 180,000; Full time

Job summary

Cypfer is seeking a Senior Consultant to lead small incident response workstreams, coordinate Consultants, and ensure high-quality deliverables for client engagements. The role combines hands-on DFIR work with leadership responsibilities across insurance, legal, and enterprise clients, operating remotely with travel on short notice.

You will own workstream planning, validate outputs, and present interim findings to stakeholders while guiding junior team members in targeted research tasks.

Qualifications

• 3–5+ years in incident response or digital forensics.
• GCFA or GCFR certification strongly preferred.
• Strong coordination across engagement workstreams.
• Experience presenting interim findings to clients.
• Basic scripting in Python and/or PowerShell.
• Experience with EDR platforms such as CrowdStrike Falcon.
• Familiarity with SIEM, SOAR, or IR orchestration.

Responsibilities

• Lead small workstreams and coordinate task execution across the team.
• Validate technical outputs and present interim findings to client stakeholders.
• Perform hands-on DFIR and post-breach recovery tasks.
• Produce client-ready artefacts and maintain accurate case notes.
• Escalate risks and ensure compliance and chain-of-custody.

Skills

Incident response

Digital forensics

Threat hunting

Python/PowerShell

Client communication

Project coordination

Travel readiness

Education

Bachelor's degree in Cybersecurity or related field

GCFA/GCFR certifications

Tools

CrowdStrike Falcon

SIEM

SOAR

Job description

Cypfer is seeking a Senior Consultant to lead small incident response workstreams, coordinate Consultants, and ensure high-quality deliverables for client engagements. The role combines hands-on DFIR work with leadership responsibilities across insurance, legal, and enterprise clients, operating remotely with travel on short notice.

You will own workstream planning, validate outputs, and present interim findings to stakeholders while guiding junior team members in targeted research tasks.