Senior DFIR Lead & On-Call Ransomware Negotiator

LevelBlue LLC; Oregon; Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Comprehensive medical, dental, and vis

401(k) with employer matching

Generous paid time off and holidays

Flexible spending accounts and health

Employee assistance programs

Training and development opportunities

Adoption assistance program

Job summary

LevelBlue LLC is seeking a highly skilled DFIR practitioner to join our global DFIR team. You will investigate and respond to cybersecurity incidents, leading digital forensic investigations across servers, endpoints, and cloud platforms while coordinating with breach counsel and insurers.

The role demands on-call availability and strong communication under pressure. You will also manage threat actor communications, develop negotiation strategies, and ensure secure, auditable channels throughout

Qualifications

• Strong knowledge of digital forensics tools and techniques, including X-Ways or similar tooling.
• Experience with incident response frameworks (NIST, SANS) and playbooks.
• Excellent written and verbal communication skills for non-technical audiences.
• Ability to work independently and manage multiple engagements.
• Experience coordinating ransomware or extortion negotiations when required.

Responsibilities

• Lead and coordinate responses to cybersecurity incidents from containment to recovery.
• Analyze breaches to determine root cause and impact.
• Conduct DFIR investigations on servers, workstations, and cloud assets.
• Collect, preserve, and analyze digital evidence per legal/regulatory standards.
• Be available for time-sensitive communications during active incidents across time zones.

Skills

Digital forensics

Incident response

Threat actor communications

Technical analysis

Strong communication

Independent worker

Crisis negotiation

Education

Bachelor's or Master's in Digital Forensics

DFIR certification

Tools

X-Ways

Forensic tooling

Threat intel tools

Job description

LevelBlue LLC is seeking a highly skilled DFIR practitioner to join our global DFIR team. You will investigate and respond to cybersecurity incidents, leading digital forensic investigations across servers, endpoints, and cloud platforms while coordinating with breach counsel and insurers.

The role demands on-call availability and strong communication under pressure. You will also manage threat actor communications, develop negotiation strategies, and ensure secure, auditable channels throughout