Senior DFIR Lead – Incident Response and Forensics

LevelBlue; United States; Hybrid; USD 110,000 - 150,000; Full time

Benefits offered by this job

Comprehensive health insurance

401(k) with employer matching

Generous PTO and holidays

FSAs/HSAs

Employee assistance program

Training and development opportunities

Adoption assistance

Job summary

LevelBlue seeks a skilled Digital Forensics and Incident Response (DFIR) Specialist to join our global DFIR team. You will lead client-facing responses, perform digital forensic investigations, and coordinate with cross-functional teams to deliver timely containment and reporting.

The ideal candidate brings strong DFIR experience, proficiency with X-Ways, and familiarity with NIST/SANS frameworks, with excellent communication and an ability to work independently on multiple engagements.

Qualifications

• Proven experience in DFIR.
• Strong knowledge of digital forensics tools and techniques, including X-Ways, or similar forensic tooling.
• Experience with incident response frameworks and methodologies, such as NIST, SANS, or similar.
• Excellent analytical and problem-solving skills.
• Strong understanding of network protocols, operating systems, and security technologies.
• Excellent written and verbal communication skills.
• Experience and interest in interfacing with clients or customers.
• Ability to work independently and manage multiple projects simultaneously.
• Flexibility to support occasional travel and work outside standard business hours, including evenings and weekends, as required annually measured against a utilization target.

Responsibilities

• Lead and coordinate responses to cybersecurity incidents in a client-facing capacity.
• Analyse and investigate security breaches to determine root cause and impact.
• Conduct digital forensic investigations on servers, workstations, networks, and SaaS platforms.
• Collect, preserve, and analyse digital evidence per legal and regulatory requirements.
• Prepare detailed incident reports that tell a narrative for non-technical audiences.
• Maintain thorough documentation of all incident response activities and investigations.
• Collaborate with DFIR, Advisory, Testing, Threat Intelligence, MDR/MSS, and client teams.
• Serve as primary contact to guide clients through forensic investigation and containment.
• Communicate updates and align with incident response processes.

Skills

DFIR

Forensic Tools

IR Frameworks

Analytical skills

Networking

Communication

Client interface

Independent work

On-call travel

Education

BS/MS in Digital Forensics or CS

DFIR certifications

Tools

X-Ways

Python

PowerShell

Azure

AWS

Oracle

Job description

LevelBlue seeks a skilled Digital Forensics and Incident Response (DFIR) Specialist to join our global DFIR team. You will lead client-facing responses, perform digital forensic investigations, and coordinate with cross-functional teams to deliver timely containment and reporting.

The ideal candidate brings strong DFIR experience, proficiency with X-Ways, and familiarity with NIST/SANS frameworks, with excellent communication and an ability to work independently on multiple engagements.