Senior Incident Response DFIR Consultant - Engagement Lead

Zurich NA; Augusta (ME); Remote; USD 100,000 - 164,000; Full time

Job summary

Zurich North America is seeking a Senior Incident Response DFIR Consultant - Engagement Lead to act as the incident response engagement lead, delivering expert consulting and digital forensics services to external clients during urgent cyber security incidents.

You will lead complex investigations, provide strategic guidance during breaches, and drive containment and recovery efforts while building long-term client relationships with C-level executives and IT leaders.

Qualifications

• Bachelor's degree or higher in Cyber Security or related field.
• Cyber Security Certification and 5+ years experience if Apprenticeship path is taken.
• High School Diploma with 7+ years experience in Cyber Security.

Responsibilities

• Lead incident response engagements for external clients focusing on DFIR investigations.
• Provide 24/7 on-call IR services remotely to contain threats.
• Conduct forensic examinations of systems, networks, and cloud environments.
• Deliver executive briefings and reports translating findings to business impact.
• Coordinate with stakeholders including IT, legal, insurance, and leadership.
• Mentor junior consultants and ensure quality client deliverables.
• Maintain case documentation, time tracking, and engagement status for billing.

Skills

Digital Forensics

Incident Response

Threat Intelligence

Client Communication

Windows/Linux Forensics

Network Forensics

Cloud Security

Forensic Tools

Ransomware Investigations

BEC Investigations

Executive Reporting

Project Management

Threat Actor Communications

Education

Bachelor's degree

Cybersecurity Apprenticeship

High School Diploma

Tools

EnCase

FTK

X-Ways

Volatility

Binalyze

Job description

Senior Incident Response DFIR Consultant - Engagement Lead

136540

Join SpearTip, the cybersecurity consulting arm of Zurich Resilience Solutions. Blending cutting-edge technologies, unique investigative skill sets, and proven cyber counterintelligence strategies, SpearTip partners with our clients to protect customer and shareholder value, shield corporate reputations, and enhance long-term profits. We are driven to protect our clients from ever-changing threat actors and to become the gold standard in incident engagements. In this role you work remotely within the U.S. and may expect up to 5% travel.

As a Senior DFIR Consultant, you will act as an incident response engagement lead, focusing on delivering expert consulting and digital forensics services to external clients during urgent cyber security incidents. You will lead complex investigations, will provide strategic guidance during security breaches, and will drive incident containment and recovery efforts. Strong candidates will showcase delivering exceptional client service and build long-term client relationships. This role requires building trust with key partners, including C-level executives, IT leaders, legal counsel, and insurance partners while managing these complex relationships during crisis situations.

Key Accountabilities:

• Lead incident response engagements for external clients, conducting digital forensics investigations, malware analysis, and threat actor attribution to identify scope, impact, and root cause of security incidents.

• Provide 24/7 on-call incident response services, remotely connecting to contain active threats, preserve evidence, and minimize business disruption.

• Conduct comprehensive forensic examinations of compromised systems, networks, and cloud environments using industry-standard tools and methodologies to support client remediation and potential legal proceedings.

• Deliver executive-level briefings and written reports to clients, translating complex technical findings into business impact assessments and actionable recommendations.

• Coordinate with client stakeholders including IT teams, legal counsel, insurance carriers, law enforcement, and executive leadership to manage incident response activities and communication strategies.

• Provide expert guidance on ransomware negotiations, business email compromise investigations, insider threat cases, and advanced persistent threat incidents.

• Mentor junior consultants and analysts, providing technical guidance and quality assurance on client deliverables.

• Maintain detailed case documentation, time tracking, and engagement status reporting to ensure accurate billing and project management.

• Partner with insurance brokers, managed service providers, and law firms to provide incident response services as part of cyber insurance claims and breach response protocols.

• Stay current on emerging threats, attack techniques, and forensic methodologies through continuous research and professional development.

• Contribute to thought leadership initiatives including blog posts, conference presentations, and client education materials.

• Business travel, as required

Additional Business Accountabilities:

• Develop scopes of work and cost estimates for incident response engagements, ensuring projects are appropriately resourced and profitably delivered.

• Identify opportunities for expanded client engagements based on investigation findings, security gaps, and client needs.

• Support business development activities including client presentations, capability demonstrations, and proposal development for new and existing clients.

• Ensure all client deliverables meet quality standards and are delivered within agreed timelines and budgets.

Basic Qualifications:

• Bachelors degree and 5 or more years experience in the Cyber Security domainOR

• Zurich Cybersecurity Technician Apprentice, including Cyber Security Certification and 6 or more years experience in the Cyber Security domainOR

• High School Diploma or Equivalent and 7 or more years experience in the Cyber Security domain

Preferred Functional/Technical Skills Qualifications:

• Digital Forensics & Incident Response - Proficiency Level Advanced

• Threat Intelligence & Malware Analysis - Proficiency Level Intermediate

• Client Communication & Stakeholder Management - Proficiency Level Advanced

• Windows/Linux Operating System Forensics - Proficiency Level Advanced

• Network Forensics & Log Analysis - Proficiency Level Intermediate

• Cloud Security (Azure/AWS/M365) - Proficiency Level Intermediate

• Forensic Tool Proficiency (EnCase, FTK, X-Ways, Volatility, Binalyze etc.) - Proficiency Level Advanced

• Ransomware & Business Email Compromise (BEC) Investigations - Proficiency Level Advanced

• Report Writing & Executive Communication - Proficiency Level Advanced

• Project Management - Proficiency Level Intermediate

• Threat Actor Communications Experience

Your pay at Zurich is based on your role, location, skills, and experience. We follow local laws to ensure fair compensation. You may also be eligible for bonuses and merit increases. If your expectations are above the listed range, we still encourage you to apply—your unique background matters to us.The pay range shown is a national average and may vary by location. The proposed Salary range for this position is $100,200.00 - $164,100.00, with short-term incentive bonus eligibility set at 15%.

We offer competitive pay and comprehensive benefits for employees and their families. [Learn more about Total Rewardshere (https://www.zurichna.com/careers/benefits) .]

Why Zurich?

At Zurich, we value your ideas and experience. We offer growth, inclusion, and a supportive environment—so you can help shape the future of insurance. Zurich North America is a leader in risk management, with over 150 years of expertise and coverage across 25+ industries, including 90% of the Fortune 500.

Join us for a brighter future—for yourself and our customers.

Zurich in North America does not discriminate based on race, ethnicity, color, religion, national origin, sex, gender expression, gender identity, genetic information, age, disability, protected veteran status, marital status, sexual orientation, pregnancy or other characteristics protected by applicable law. Equal Opportunity Employer disability/vets.

Zurich complies with 18 U.S. Code § 1033.

Location(s): AM - Remote Work (US)

Remote Working: Yes

Schedule: Full Time

Employment Sponsorship Offered: No

EOE Disability / Veterans