Senior Digital Forensics and Incident Response (DFIR) Consultant

Ransomware Recovery; Phoenix (AZ); Remote; USD 90,000 - 140,000; Full time

Job summary

Ransomware Recovery is seeking a Senior Consultant to lead small DFIR workstreams on incident response engagements. You will coordinate Consultants, own workstream planning, and present interim findings to clients while executing hands-on DFIR tasks across insurance, legal, and enterprise engagements.

Travel to client sites and availability for on-call are required. The role blends technical execution with service delivery leadership, requiring 3-5+ years in related cybersecurity roles, and

Qualifications

• 3-5+ years of experience in incident response, digital forensics, or a related cybersecurity role.
• Advanced capability in DFIR and post-breach recovery analysis; GCFA or GCFR certification strongly preferred.
• Experience coordinating plans, tasks, and risks across an engagement workstream with multiple contributors.
• Experience presenting interim findings to client stakeholders, managing expectations, and leading client-ready deliverables.
• Basic scripting proficiency in Python and/or PowerShell to automate forensic or recovery tasks.

Responsibilities

• Lead small workstreams under supervision; coordinate task execution across the team and ensure deliverable quality and alignment with client objectives.
• Own workstream planning, stand-ups, and risk tracking across active engagements.
• Validate technical outputs; present interim findings to client stakeholders and manage expectations.
• Deliver discrete work packages including forensic acquisition, IOC triage, and recovery steps.
• Maintain accurate case notes and produce client-ready artefacts; adhere to SOPs and QA standards.
• Escalate risks early; follow chain-of-custody and compliance requirements.
• Analyze triage collections and IoCs; review logs to identify suspicious activity.
• Collect forensic disk and memory images from endpoints and servers.
• Drive event correlation and timeline construction across the engagement.
• Direct junior team members in targeted threat research tasks.
• Participate in rotating on-call; travel up to 50% with 24-48 hour notice.

Skills

Incident response

Digital forensics

Team coordination

Python/PowerShell scripting

CrowdStrike Falcon

Threat hunting

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field

Tools

CrowdStrike Falcon

SIEM/SOAR platforms

Job description

About the Role

The Senior Consultant leads small workstreams within active incident response and recovery engagements, coordinating Consultants and ensuring deliverable quality and alignment with client objectives. Operating under the direction of a Manager or Senior Manager, the Senior Consultant owns workstream planning, validates technical outputs, and presents interim findings to client stakeholders - while continuing to execute hands-on DFIR and PBR tasks across insurance, legal, and enterprise client engagements. The role sits at the intersection of technical execution and emerging service delivery leadership.

Core Responsibilities

• Understand the client challenge and objective; ensure operational tasks across the workstream are executed in line with the path to recovery.

• Lead small workstreams under the supervision of a Manager or Senior Manager; coordinate task execution across the team and ensure deliverable quality and alignment with client objectives.

• Own workstream planning, stand-ups, and risk tracking across active engagements.

• Validate technical outputs; present interim findings to client stakeholders and manage expectations.

• Deliver discrete work packages including forensic acquisition, IOC triage, and recovery steps.

• Maintain accurate case notes and produce client-ready artefacts; adhere to SOPs and QA standards throughout all engagements.

• Escalate risks early; follow chain‑of‑custody and compliance requirements at all times.

• Analyze triage collections and artefacts for indicators of compromise (IoCs) and potentially malicious activity.

• Review logs from host systems and appliances to identify suspicious activities.

• Collect forensic disk and memory images from physical and virtual endpoints and servers.

• Own and drive event correlation and timeline construction across the engagement.

• Conduct independent threat research based on IOCs collected during investigations, and direct junior team members in targeted research tasks.

• Participate in a rotating on‑call schedule; ability to work on weekends and outside normal business hours as needed.

• This role is remote but requires the ability to travel on short notice to a client site up to 50%. Must maintain flexibility to travel within 24-48 hours' notice for deployments typically 1-2 weeks in duration.

Technical Requirements

• 3-5+ years of experience in incident response, digital forensics, or a related cybersecurity role.

• Advanced capability in DFIR and post-breach recovery analysis - able to perform deeper forensic investigation and lead technical analysis workstreams; GCFA or GCFR certification is strongly preferred.

• Demonstrated ability to coordinate plans, tasks, and risks across an engagement workstream with multiple contributors, maintaining quality and alignment with client objectives.

• Experience presenting interim findings to client stakeholders, managing expectations, and leading the creation of client‑ready deliverables.

• Basic scripting proficiency in Python and/or PowerShell to automate forensic or recovery tasks.

• Working knowledge of endpoint forensics - evidence acquisition, preservation, and artefact triage across physical and virtual systems.

• Hands‑on experience operating EDR platforms (e.g., CrowdStrike Falcon) for threat hunting, host isolation, and telemetry collection.

• Familiarity with SIEM, SOAR, or IR orchestration platforms.

• Ability to perform estimation and short‑cycle planning within an engagement workstream.

Business Responsibilities

• Exhibit strong customer service and consulting skills in all client interactions.

• Adhere to client and internal policies, procedures, and security practices.

• Remain calm, composed, and articulate in high‑pressure client situations.

• Exhibit excellent relationship management and communication skills.

• Ensure a high level of confidentiality due to having access to sensitive client and incident data.

Preferred Skills

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field - or equivalent hands‑on experience.

• Industry certifications such as GCFA, GCFR, GCIH, CCFR, CCHF, AWS Certified or similar are a strong asset.

• Exposure to threat hunting, network forensics, or malware analysis methodologies.

• Experience in a professional services or consulting environment.