Senior DFIR Lead: Incident Response & Forensics

Trustwave; United States; Hybrid; USD 95,000 - 150,000; Full time

Benefits offered by this job

Medical insurance

401(k) plan

Paid time off

HSA/FSA

Employee assistance

Training & development

Adoption assistance

Job summary

LevelBlue seeks a skilled DFIR Specialist to join our Global LevelBlue DFIR team. You will investigate and respond to cybersecurity incidents, perform digital forensics, and serve as the primary client contact, delivering timely findings and reports.

The role demands deep technical expertise, strong analytical skills, and the ability to manage multiple engagements from forensics to log analysis to final documentation, with occasional travel and after-hours support as required.

Qualifications

• Proven DFIR experience with incident response and forensics.
• Experience collecting and analyzing digital evidence per regulations.
• Strong written and verbal communication for non-technical audiences.

Responsibilities

• Lead and coordinate responses to cybersecurity incidents for clients.
• Perform digital forensic investigations on servers, workstations, and cloud artifacts.
• Prepare detailed incident reports with a narrative for stakeholders.
• Maintain thorough documentation of all IR activities and forensics.
• Collaborate with DFIR, Advisory, Threat Intelligence and MDR/MSS teams.
• Interface with client IT, legal and vendors during engagements.

Skills

DFIR

X-Ways

incident analysis

client communication

forensic tooling

Education

Bachelor's or Master’s in Digital Forensics or CS

Tools

X-Ways

forensic tooling

Job description

LevelBlue seeks a skilled DFIR Specialist to join our Global LevelBlue DFIR team. You will investigate and respond to cybersecurity incidents, perform digital forensics, and serve as the primary client contact, delivering timely findings and reports.

The role demands deep technical expertise, strong analytical skills, and the ability to manage multiple engagements from forensics to log analysis to final documentation, with occasional travel and after-hours support as required.