Senior DFIR Lead — Incident Response & Forensics

Precision Labs; Northern (KY); Hybrid; USD 108,000 - 130,000; Full time

Benefits offered by this job

RSUs

ESPP

Flexible time off

Paid holidays and sick time

Parental leave

Medical, dental, vision

Job summary

SentinelOne seeks a Senior DFIR Analyst to act as the technical lead on breach response investigations for 24x7x365 operations. You will own case evidence, strategy, and customer communications while applying deep threat hunting and endpoint, network, and cloud forensics.

You will mentor analysts, improve workflows, and ensure high-quality, defensible findings with clear documentation. This role requires strong scripting and collaboration across regions.

Qualifications

• Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science, or related field (or equivalent practical self-study).
• 4+ years hands-on experience in digital forensics, incident response, or threat hunting.
• Experience leading complex breach response engagements and independent work.
• Comfort with Windows, Linux, and macOS environments.
• Expert-level with forensic tools like X-Ways Forensics, Axiom, FTK.
• Strong EDR/XDR and SIEM experience.
• Cloud incident response knowledge (AWS/Azure/GCP).
• Scripting ability (Python preferred) for automation.
• Clear, evidence-backed investigative reporting.

Responsibilities

• Serve as technical lead on DFIR engagements and align work with scope and client expectations.
• Support case intake by gathering initial technical details and assessing scope.
• Conduct EDR-driven incident response and forensic analysis across endpoints, networks, and cloud services.
• Develop tactical containment guidance and remediation tailored to each engagement.
• Contribute attacker techniques to the knowledge base.
• Acquire and preserve forensic evidence with proper chain-of-custody and documentation.
• Prepare interim status updates and deliverables.
• Own evidence handling and quality of investigative reports.

Skills

Digital forensics

Incident response

Threat hunting

Windows/Linux/macOS

Python scripting

Evidence handling

Communication to stakeholders

Education

Bachelor's or Master's in Digital Forensics/C Cybersecurity/CS

Tools

X-Ways Forensics

Axiom

FTK

EDR/XDR (SentinelOne)

SIEM

Job description

SentinelOne seeks a Senior DFIR Analyst to act as the technical lead on breach response investigations for 24x7x365 operations. You will own case evidence, strategy, and customer communications while applying deep threat hunting and endpoint, network, and cloud forensics.

You will mentor analysts, improve workflows, and ensure high-quality, defensible findings with clear documentation. This role requires strong scripting and collaboration across regions.