Senior DFIR Incident Response Lead — Remote

Palo Alto Networks; United States; Remote; USD 136,000 - 187,000; Full time

Job summary

Palo Alto Networks is seeking a seasoned security professional to lead incident response engagements across Windows, Linux, and Mac OS X, guiding clients from scoping through containment and remediation. This remote role emphasizes collaboration with global teams and delivering comprehensive security solutions.

The role requires hands-on forensics using EnCase, FTK, X-Ways, Splunk and related tools, mentoring junior staff, and traveling up to 20% as needed. Remote work setup supported.

Qualifications

• Bachelor’s degree with 8 years of experience, or Master’s degree with 6 years of experience, or PhD with 3 years of experience in Information Security, Computer Science, Digital Forensics, or a related field.
• Direct experience in incident response or digital forensics consulting.
• Proficiency with host‑based forensics and data breach response methodologies.
• Hands‑on experience with forensic tools such as EnCase, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, or WireShark.
• Ability to travel as needed to meet business demands, averaging up to 20%.

Responsibilities

• Manage and lead incident response engagements, including scoping work, guiding clients through forensic investigations, and containing security incidents.
• Perform reactive incident response and host-based analysis on Windows, Linux, and Mac OS X systems to identify Indicators of Compromise (IOCs).
• Examine firewall, web, database, and other log sources to identify evidence of malicious activity and attack vectors.
• Investigate data breaches using forensic tools like EnCase, FTK, X-Ways, SIFT, and Splunk to determine the source and scope of compromises.
• Provide clients with clear, actionable recommendations for long‑term remediation and security posture improvement.
• Collaborate with internal teams and external stakeholders to ensure alignment and deliver comprehensive solutions.
• Act as a mentor for junior team members, sharing expertise in incident response and digital forensics best practices.

Skills

Incident response

Digital forensics

Client engagement

Leadership

Travel readiness

Education

Bachelor’s degree in Information Security or related field

Master’s degree in Information Security or related field

PhD in Information Security or related field

Tools

EnCase

FTK

X-Ways

SIFT

Splunk

Redline

Volatility

Wireshark

Job description

Palo Alto Networks is seeking a seasoned security professional to lead incident response engagements across Windows, Linux, and Mac OS X, guiding clients from scoping through containment and remediation. This remote role emphasizes collaboration with global teams and delivering comprehensive security solutions.

The role requires hands-on forensics using EnCase, FTK, X-Ways, Splunk and related tools, mentoring junior staff, and traveling up to 20% as needed. Remote work setup supported.