Sr. Incident Examiner/Negotiator, DFIR

Forensic Focus; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Forensic Focus in the United States is seeking a Senior Incident Examiner/Negotiator to lead incident response and forensic investigations across servers, endpoints, networks, and SaaS platforms. The role involves identifying root causes and collecting evidence while coordinating with leadership.

You will directly negotiate with ransomware and extortion actors, advising legal counsel and insurers. The position requires deep DFIR expertise and strong judgment under pressure, with on-call

Qualifications

• Deep technical DFIR expertise in investigations.
• Experience with forensic evidence collection, log analysis and reporting.
• Ability to negotiate with threat actors under pressure.
• Experience coordinating with legal, insurers and leadership.

Responsibilities

• Lead incident response and forensic investigations across systems.
• Negotiate with ransomware and extortion actors.
• Coordinate with legal counsel, insurers, and engagement leadership.
• Provide updates and reports to stakeholders.

Skills

DFIR expertise

Forensic evidence collection

Log analysis

Report writing

Negotiation skills

Strong communication

Job description

# Sr. Incident Examiner/Negotiator, DFIR*LevelBlue***United States**Remote · Senior · Full-time### The RoleThis position leads incident response and forensic investigations across servers, endpoints, network systems and SaaS platforms, identifying root causes and collecting evidence. It also involves directly negotiating with ransomware and extortion threat actors, coordinating with legal counsel, insurers and engagement leadership.### Skills & ExperienceRequires deep technical DFIR expertise, including forensic evidence collection, log analysis and report writing, alongside strong judgment and communication skills for high-pressure negotiation scenarios involving ransomware actors and extortion demands.### Who It SuitsSuited to experienced DFIR practitioners comfortable working independently under pressure, available for on-call rotations, and interested in combining technical forensic investigation with threat actor negotiation responsibilities.