Senior DFIR Investigator Reactive Response (Remote)

Palo Alto Networks; Burbank (CA); Remote; USD 133,000 - 183,000; Full time

Job summary

Palo Alto Networks is seeking a Senior Consultant to join Unit 42 in Reactive Services, leading DFIR investigations across enterprise environments and delivering actionable findings to clients in fast-paced engagements.

You will own investigative workstreams, collaborate with senior consultants, and contribute to playbooks, tooling, and knowledge sharing while staying current on evolving threats.

Qualifications

• Hands-on enterprise DFIR experience.
• Proficiency with forensic tools, evidence acquisition, and log analysis.
• Experience investigating Windows; familiarity with Linux, macOS, or cloud environments.
• Strong technical judgment and client communication.
• Relevant degree or equivalent practical experience.
• Preferred Consulting or incident response services background.
• MITRE ATT&CK knowledge.
• GCFA, GCFE, GCIH, or similar certifications.
• Willingness to travel up to 20%.

Responsibilities

• Execute digital forensics and incident response investigations involving ransomware, unauthorized access, and other cybersecurity incidents.
• Own assigned investigative workstreams, escalating findings and blockers to the engagement lead.
• Analyze endpoint, host, network, identity, and cloud evidence to establish incident timelines, attacker behavior, and scope of compromise.
• Perform forensic acquisition and analysis of systems, memory, logs, and endpoint telemetry.
• Support incident containment, remediation, and recovery through evidence-based recommendations.
• Document investigative activities and prepare clear technical reports and client updates.
• Follow established evidence handling and chain-of-custody procedures.
• Collaborate with engagement teams to deliver timely, high-quality client outcomes.
• Contribute to investigation playbooks, tools, and knowledge sharing.
• Maintain knowledge of emerging threats, attacker techniques, and forensic methodologies.

Skills

DFIR experience

Forensic tools

Log analysis

Windows investigations

Linux/macOS/cloud

Client communication

ATT&CK knowledge

Certifications

Travel willingness

Education

Relevant degree or equivalent experience

Tools

Forensic tools

Job description

Palo Alto Networks is seeking a Senior Consultant to join Unit 42 in Reactive Services, leading DFIR investigations across enterprise environments and delivering actionable findings to clients in fast-paced engagements.

You will own investigative workstreams, collaborate with senior consultants, and contribute to playbooks, tooling, and knowledge sharing while staying current on evolving threats.