Senior DFIR Lead & Ransomware Negotiation Specialist

Trustwave; United States; Sur place; USD 120 000 - 180 000; Plein temps

Avantages offerts par ce poste

Medical, dental, vision insurance

401(k) with employer matching

Paid time off

Flexible spending accounts

Employee assistance programs

Training and development opportunities

Adoption assistance

Résumé du poste

LevelBlue is seeking a highly capable Digital Forensics and Incident Response (DFIR) practitioner to join our Global LevelBlue DFIR team in the United States. The role involves investigating cybersecurity incidents, performing forensic analyses, and delivering clear reports for clients.

You will lead containment, eradication, and recovery efforts, support time-sensitive communications during active incidents, and collaborate with leadership across advisory, testing, and threat intelligence teams.

Qualifications

• Strong knowledge of digital forensics tools and techniques.
• Experience with incident response frameworks and methodologies.
• Excellent analytical and problem-solving skills.
• Ability to work independently on multiple projects.

Responsabilités

• Lead and coordinate responses to cybersecurity incidents from discovery to recovery.
• Analyze breaches to determine root cause and impact.
• Conduct forensic investigations on servers, workstations, and cloud services.
• Preserve digital evidence per legal and regulatory requirements.
• Communicate with stakeholders during active ransomware/extortion incidents.

Connaissances

Digital forensics

Incident response

Threat actor communications

Threat intelligence

Log analysis

Network protocols

Python scripting

Formation

Bachelor's/Master's in DFIR or CS

Outils

X-Ways

Forensic tooling

Industry frameworks (NIST/SANS)

Description du poste

LevelBlue is seeking a highly capable Digital Forensics and Incident Response (DFIR) practitioner to join our Global LevelBlue DFIR team in the United States. The role involves investigating cybersecurity incidents, performing forensic analyses, and delivering clear reports for clients.

You will lead containment, eradication, and recovery efforts, support time-sensitive communications during active incidents, and collaborate with leadership across advisory, testing, and threat intelligence teams.