Senior DFIR Strategist — Incident Response & Forensics

LevelBlue, LLC.; Northern (KY); Hybrid; USD 90,000 - 140,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

401(k) with employer matching

Paid time off & holidays

Flexible spending accounts & health-s

Employee assistance program

Training & development opportunities

Adoption assistance

Job summary

LevelBlue is seeking a skilled DFIR Specialist to join our Global DFIR team. You will investigate and respond to cybersecurity incidents, lead forensics, and act as the primary client contact, delivering timely results from analysis to report writing.

The role requires deep technical expertise, strong analytical skills, and the ability to meet client deadlines. Travel and on-call participation may be required to ensure incident containment and rapid recovery.

Qualifications

• Proven DFIR experience with forensic investigations.
• Strong knowledge of digital forensics tools such as X-Ways.
• Experience with incident response frameworks (NIST/SANS).
• Excellent written and verbal communication, client-facing.

Responsibilities

• Lead and coordinate responses to cybersecurity incidents for clients.
• Analyse breaches to determine root cause and impact.
• Conduct forensic investigations across servers, workstations, networks, and SaaS platforms.
• Prepare incident reports with narrative findings for non-technical audiences.
• Document all incident response activities thoroughly.

Skills

DFIR experience

Digital forensics

Incident response

Client communication

Analytical thinking

Independent work

Travel flexibility

Education

Bachelor's or Master's in Digital Forensics or Computer Science

Tools

X-Ways

Job description

LevelBlue is seeking a skilled DFIR Specialist to join our Global DFIR team. You will investigate and respond to cybersecurity incidents, lead forensics, and act as the primary client contact, delivering timely results from analysis to report writing.

The role requires deep technical expertise, strong analytical skills, and the ability to meet client deadlines. Travel and on-call participation may be required to ensure incident containment and rapid recovery.