Senior DFIR Lead - Remote Incident Response & Forensics

Soteria, LLC; Charleston (SC); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Soteria, LLC in Charleston, SC, seeks an experienced incident response professional to help clients recover quickly from security incidents and to implement lasting improvements. You will lead IR engagements, triage and analyze data to determine scope, coordinate resources, and communicate findings to both technical and non-technical stakeholders, while mentoring junior analysts and collaborating with the MDR team.

This role is fully remote with no mandatory travel.

Qualifications

• 5+ years of digital forensics and incident response experience.
• Experience leading engagements and communicating with clients.
• Proficiency with Windows, Linux, Unix, and MacOS forensics and logs.

Responsibilities

• Provide clients with guidance during incident response and recovery.
• Lead security incident and data breach investigations, triage, and data collection.
• Own DFIR processes to improve team capabilities and timely delivery.
• Coordinate resources to deliver engagements to meet client needs.
• Identify gaps in tooling and capabilities and implement fixes.
• Document findings and recommendations for clients.
• Maintain client relationships post-engagement for remediation support.
• Keep current on security trends and practices.
• Collaborate with MDR team to improve detection capabilities.
• Mentor DART members and participate in DFIR initiatives.

Skills

Digital forensics

Incident response

Leadership

Client communication

DFIR tooling

Scripting

Job description

Soteria, LLC in Charleston, SC, seeks an experienced incident response professional to help clients recover quickly from security incidents and to implement lasting improvements. You will lead IR engagements, triage and analyze data to determine scope, coordinate resources, and communicate findings to both technical and non-technical stakeholders, while mentoring junior analysts and collaborating with the MDR team.

This role is fully remote with no mandatory travel.