Senior Incident Response Consultant | $110,000 – $145,000

Maestro Search Limited; Tysons (VA); On-site; USD 110,000 - 145,000; Full time

Job summary

Maestro Search Limited is seeking a Senior Incident Response Consultant in Tysons, VA, offering a $110,000 - $145,000 base range plus bonus and comprehensive benefits. You will lead end-to-end forensic investigations across on-premise, cloud and hybrid environments, guiding client teams through containment and recovery while communicating results to executives.

Ideal candidates have 3+ years in incident response, multiple GIAC certifications, and a proven track record of handling high-impact

Qualifications

• Three or more years in incident response.
• 2 or more GIAC certifications (e.g., GCIH, GREM, GCNA).
• Proven ownership and resolution of complex investigations.

Responsibilities

• Lead host, network, cloud and application forensics on ransomware, BEC, nation-state and insider cases.
• Give clients immediate containment direction while the incident is still moving.
• Turn attacker behaviour into durable detection logic and indicators the practice reuses across future casework.
• Scope new engagements and run clients through the full response lifecycle from first call to final report.
• Produce findings that stand up in front of boards, breach counsel, carriers and regulators.

Skills

Incident response

Consulting experience

Education

GIAC certifications

Tools

CrowdStrike

SentinelOne

Huntress

FTK

AXIOM

PowerShell

Python

Job description

Senior Incident Response Consultant | $110,000 - $145,000

A specialist consulting client of ours is hiring a Senior Incident Response Consultant into an established DFIR practice, reporting to the Director of Incident Response.

In this position, you will lead the forensic investigation end to end and stay with it through containment and recovery, directing the client's own teams on what needs to happen while the incident is still live.

What You'll Own

• Lead host, network, cloud and application forensics on ransomware, business email compromise, nation-state and insider cases
• Give clients immediate, usable containment direction while the incident is still moving
• Turn attacker behaviour into durable detection logic and indicators the practice reuses across future casework
• Scope new engagements and run clients through the full response lifecycle from first call to final report
• Produce findings that stand up in front of boards, breach counsel, carriers and regulators

The Technical Environment

• Disk and memory forensics, network traffic analysis, Active Directory and Windows internals
• Cloud and virtualisation estates including Microsoft 365, Azure, VMware ESXi and Hyper-V
• EDR tooling of the CrowdStrike, SentinelOne and Huntress type, alongside forensic suites such as FTK & AXIOM
• PowerShell and Python for automation, custom tooling and anything the case needs that does not yet exist

What They're Looking For

• Three or more years in incident response, ideally consultancy-side
• 2 or more GIAC certifications, such as GCIH, GREM, GCNA or equivalent
• A proven track record of ownership & sesolution of complex, high-impact investigations.

Why This One Stands Out

• A client list most Incident Response practices would love to have: global manufacturers, national health systems, Fortune 500 financial services
• Casework that is technically demanding and multi-jurisdictional, landing here because clients have been recommended and they need SME level support
• An experienced leadership team and a number of expert level Senior and Principal Incident Responders to work with and learn from
• A bench deep enough that you are never the only experienced pair of hands on the engagement
• Funding and a growth plan behind the practice, which means budget, headroom and a genuine path upward

Salary is $110,000 to $145,000 depending on experience, plus bonus and a great benefits package.