Senior DFIR Lead: Incident Response & Forensics

Forensic Focus; Northern (KY); Hybrid; USD 92,000 - 154,000; Full time

Job summary

Forensic Focus in the United States seeks a Sr. Principal Consultant in DFIR to lead end-to-end incident response engagements, from identification and containment to forensic analysis and recovery.

You'll perform host and network forensics, cloud investigations (Azure/AWS/GCP), log analysis, and craft narrative incident reports for technical and non-technical audiences. Candidates should bring DFIR experience, familiarity with X-Ways, NIST/SANS frameworks, and scripting in Python or PowerShell;

Qualifications

• Proven DFIR experience with end-to-end incident response.
• Familiarity with X-Ways or similar forensic tooling.
• Knowledge of IR frameworks (NIST/SANS).
• Cloud investigations across Azure, AWS or GCP.
• Scripting skills in Python or PowerShell.

Responsibilities

• Lead end-to-end incident response engagements from identification to recovery.
• Perform host and network forensics and log analysis.
• Prepare clear, narrative incident reports for technical and non-technical audiences.
• Coordinate with client legal, compliance and IT teams as needed.
• Present findings to senior stakeholders.

Skills

DFIR experience

X-Ways

NIST

SANS

Python

PowerShell

Education

Relevant degree

Tools

Azure

AWS

GCP

Job description

Forensic Focus in the United States seeks a Sr. Principal Consultant in DFIR to lead end-to-end incident response engagements, from identification and containment to forensic analysis and recovery.

You'll perform host and network forensics, cloud investigations (Azure/AWS/GCP), log analysis, and craft narrative incident reports for technical and non-technical audiences. Candidates should bring DFIR experience, familiarity with X-Ways, NIST/SANS frameworks, and scripting in Python or PowerShell;