Senior DFIR Lead - Incident Response & Forensics

Forensic Focus; United States; On-site; USD 150,000 - 200,000; Full time

Job summary

Forensic Focus in the United States is seeking an experienced DFIR leader to drive incident response and digital forensics across multiple business units. You will oversee investigations spanning endpoint, network, memory, mobile, cloud and Microsoft 365 environments.

You will maintain response playbooks, coordinate major incidents, strengthen forensic tooling and evidence handling, and run tabletop exercises and post-incident reviews to mature programs across operating companies.

Qualifications

• 7+ years in incident response or digital forensics.
• 3+ years managing DFIR staff.
• Hands-on experience with AWS, Azure, Kubernetes, Microsoft 365/Entra, and mobile forensics (iOS/Android).
• Familiarity with chain of custody, legal hold, eDiscovery, NIST and MITRE ATT&CK.
• Scripting in KQL, Python or PowerShell.

Responsibilities

• Lead incident response and forensic investigations across endpoint, network, memory, mobile, cloud and Microsoft 365 environments.
• Maintain response playbooks, coordinate major incidents, and strengthen evidence handling.
• Run tabletop exercises and post‑incident reviews to mature programs across operating companies.

Skills

DFIR leadership

Digital forensics

Staff management

Cloud forensics

Forensic tooling

Tools

AWS

Azure

Kubernetes

Microsoft 365/Entra

iOS/Android forensics

Job description

Forensic Focus in the United States is seeking an experienced DFIR leader to drive incident response and digital forensics across multiple business units. You will oversee investigations spanning endpoint, network, memory, mobile, cloud and Microsoft 365 environments.

You will maintain response playbooks, coordinate major incidents, strengthen forensic tooling and evidence handling, and run tabletop exercises and post-incident reviews to mature programs across operating companies.