Consultant, DFIR, Reactive Services (Unit 42) - Remote

Palo Alto Networks Unit 42 is seeking a remote DFIR consultant for Reactive Services to support incident response engagements. You will conduct digital forensics across multiple OS, analyze logs, and communicate findings to clients, with travel as needed.

• Support reactive incident response engagements and digital forensics investigations
• Perform host-based forensic analysis across Windows, Linux, and macOS to identify IOCs
• Assist in investigating data breaches using forensic and SIEM/EDR tools
• Analyze logs from firewalls, endpoints, web, and other systems to identify evidence of compromise
• Communicate findings effectively to both technical and non-technical audiences with guidance from senior team members

Client-facing DFIR role focused on host-based forensics, IOC identification, and incident containment using EnCase/FTK/Splunk and EDR/SIEM tools on Windows, Linux, and macOS.

The ideal candidate is a mid-level cybersecurity consultant with 3+ years in digital forensics and incident response, hands-on experience with SIEM/EDR tools, and strong client-facing communication skills. Willingness to travel and work remotely is required.

Preferred