Senior DFIR Lead – Remote Incident Response & Forensics

RGA; United States; Hybrid; USD 140,000 - 210,000; Full time

Job summary

RGA is seeking a senior incident response professional to lead complex cyber investigations and strengthen enterprise resilience across global environments. The role combines hands-on DFIR expertise with strategic advisory capabilities and security program leadership.

You will conduct host, network, cloud, identity, and SaaS investigations, develop containment strategies, and produce board-ready updates. Remote or hybrid work eligible, with on-call rotation and international collaboration.

Qualifications

• 5+ years in incident response, DFIR, or security operations.
• Experience leading major cyber incidents including ransomware and cloud breaches.
• Strong forensics using standard tools and methodologies.

Responsibilities

• Lead enterprise incident response and cyber crisis engagements from detection through recovery.
• Direct host, network, cloud, identity, and SaaS investigations across Windows, Linux, macOS, M365, AWS, Azure, and hybrid environments.
• Perform advanced threat hunting and compromise assessments using SIEM, EDR, forensic, and threat intel platforms.
• Produce executive briefings, technical reports, and post-incident reviews.

Skills

DFIR

Incident response

Security operations

Threat hunting

Executive communication

Global enterprise risk

Education

Bachelor's degree in Cybersecurity/Information Security/CS

Certifications (GCFA/GCFE/GCIH/GCIA/CISSP/CISM)

Tools

Splunk

Microsoft Defender

CrowdStrike Falcon

ServiceNow SIR

FTK

EnCase

X-Ways

Magnet AXIOM

SIFT

Job description

RGA is seeking a senior incident response professional to lead complex cyber investigations and strengthen enterprise resilience across global environments. The role combines hands-on DFIR expertise with strategic advisory capabilities and security program leadership.

You will conduct host, network, cloud, identity, and SaaS investigations, develop containment strategies, and produce board-ready updates. Remote or hybrid work eligible, with on-call rotation and international collaboration.