Senior DFIR Lead & Incident Response Consultant

Ransomware Recovery; Phoenix (AZ); Remote; USD 90,000 - 140,000; Full time

Job summary

Ransomware Recovery is seeking a Senior Consultant to lead small DFIR workstreams on incident response engagements. You will coordinate Consultants, own workstream planning, and present interim findings to clients while executing hands-on DFIR tasks across insurance, legal, and enterprise engagements.

Travel to client sites and availability for on-call are required. The role blends technical execution with service delivery leadership, requiring 3-5+ years in related cybersecurity roles, and

Qualifications

• 3-5+ years of experience in incident response, digital forensics, or a related cybersecurity role.
• Advanced capability in DFIR and post-breach recovery analysis; GCFA or GCFR certification strongly preferred.
• Experience coordinating plans, tasks, and risks across an engagement workstream with multiple contributors.
• Experience presenting interim findings to client stakeholders, managing expectations, and leading client-ready deliverables.
• Basic scripting proficiency in Python and/or PowerShell to automate forensic or recovery tasks.

Responsibilities

• Lead small workstreams under supervision; coordinate task execution across the team and ensure deliverable quality and alignment with client objectives.
• Own workstream planning, stand-ups, and risk tracking across active engagements.
• Validate technical outputs; present interim findings to client stakeholders and manage expectations.
• Deliver discrete work packages including forensic acquisition, IOC triage, and recovery steps.
• Maintain accurate case notes and produce client-ready artefacts; adhere to SOPs and QA standards.
• Escalate risks early; follow chain-of-custody and compliance requirements.
• Analyze triage collections and IoCs; review logs to identify suspicious activity.
• Collect forensic disk and memory images from endpoints and servers.
• Drive event correlation and timeline construction across the engagement.
• Direct junior team members in targeted threat research tasks.
• Participate in rotating on-call; travel up to 50% with 24-48 hour notice.

Skills

Incident response

Digital forensics

Team coordination

Python/PowerShell scripting

CrowdStrike Falcon

Threat hunting

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field

Tools

CrowdStrike Falcon

SIEM/SOAR platforms

Job description

Ransomware Recovery is seeking a Senior Consultant to lead small DFIR workstreams on incident response engagements. You will coordinate Consultants, own workstream planning, and present interim findings to clients while executing hands-on DFIR tasks across insurance, legal, and enterprise engagements.

Travel to client sites and availability for on-call are required. The role blends technical execution with service delivery leadership, requiring 3-5+ years in related cybersecurity roles, and