Senior DFIR Lead — Remote Incident Response & Forensics

Soteria-LLC; Charleston (SC); Remote; USD 120,000 - 180,000; Full time

Job summary

Soteria, a Charleston-based cybersecurity firm, is seeking a seasoned DFIR professional to guide incident response and recovery efforts for clients. You will lead investigations, triage data, and drive DFIR process improvements while coordinating cross-functional teams to deliver high-quality engagements.

You will mentor DART staff, develop new capabilities, and maintain strong client relationships to support long-term remediation and security posture enhancements.

Qualifications

• Minimum 5+ years in digital forensics or incident response.
• Experience with network breach investigations and ransomware incidents.
• Ability to identify IOCS and triage data.
• Proven leadership and client-facing communication.
• Proficient in Windows/Linux/MacOS forensics.

Responsibilities

• Provide clients with advice and guidance during incident response and recovery.
• Lead security incident and data breach investigations, triaging and collecting forensically valuable data.
• Own multiple DFIR processes to improve team capabilities and ensure timely delivery.
• Coordinate resources to deliver engagements on time and meet client needs.
• Identify gaps in tooling and capabilities and drive remediation.
• Document findings and present recommendations to clients.
• Maintain client relationships post-engagement for remediation guidance.
• Stay current on security trends and technologies.
• Collaborate with managed detection and response teams to improve detection.
• Mentor other DART team members and build capacity.
• Participate as a DFIR SME in company initiatives.

Skills

Digital forensics

Incident response

Leadership

Client-facing

Written communication

Scripting

Windows

Linux

MacOS forensics

SIEM

Tools

Axiom

FTK

SIEM

Job description

Soteria, a Charleston-based cybersecurity firm, is seeking a seasoned DFIR professional to guide incident response and recovery efforts for clients. You will lead investigations, triage data, and drive DFIR process improvements while coordinating cross-functional teams to deliver high-quality engagements.

You will mentor DART staff, develop new capabilities, and maintain strong client relationships to support long-term remediation and security posture enhancements.