Sr. Principal Consultant, DFIR

Forensic Focus; Northern (KY); Hybrid; USD 92,000 - 154,000; Full time

Job summary

Forensic Focus in the United States seeks a Sr. Principal Consultant in DFIR to lead end-to-end incident response engagements, from identification and containment to forensic analysis and recovery.

You'll perform host and network forensics, cloud investigations (Azure/AWS/GCP), log analysis, and craft narrative incident reports for technical and non-technical audiences. Candidates should bring DFIR experience, familiarity with X-Ways, NIST/SANS frameworks, and scripting in Python or PowerShell;

Qualifications

• Proven DFIR experience with end-to-end incident response.
• Familiarity with X-Ways or similar forensic tooling.
• Knowledge of IR frameworks (NIST/SANS).
• Cloud investigations across Azure, AWS or GCP.
• Scripting skills in Python or PowerShell.

Responsibilities

• Lead end-to-end incident response engagements from identification to recovery.
• Perform host and network forensics and log analysis.
• Prepare clear, narrative incident reports for technical and non-technical audiences.
• Coordinate with client legal, compliance and IT teams as needed.
• Present findings to senior stakeholders.

Skills

DFIR experience

X-Ways

NIST

SANS

Python

PowerShell

Education

Relevant degree

Tools

Azure

AWS

GCP

Job description

# Sr. Principal Consultant, DFIR*LevelBlue***United States**Lead/Principal · Full-time### The RoleThis senior consulting position sits within a global DFIR team and focuses on leading end-to-end incident response engagements — from initial identification and containment through to forensic analysis and recovery. Day-to-day work spans host and network forensics, cloud platform investigations, log analysis, and the preparation of clear, narrative-driven incident reports for both technical and non-technical audiences.### Skills & ExperienceCandidates should bring proven DFIR experience and strong familiarity with forensic tooling such as X-Ways, alongside knowledge of IR frameworks including NIST and SANS. Cloud platform experience across Azure, AWS or GCP is valued, as are scripting skills in Python or PowerShell. Industry-recognised DFIR certifications and a relevant degree are preferred.### Who It SuitsThis role suits an experienced DFIR professional comfortable working independently on complex engagements under pressure, managing multiple concurrent investigations while collaborating with client legal, compliance and IT teams. Those who combine deep technical forensics skills with the ability to communicate findings clearly to senior stakeholders will thrive here.Typical advertised salary forDigital Forensics roles in United States:**$92,000–$154,000**(median $122,000 — from221 recent listings analysed by Forensic Focus).Compare Digital Forensics salaries in United States →Certifications mentioned:SANS — find training for these on theDFIR Training Finder.Learn More/Apply