Principal Consultant, DFIR, Reactive Services (Unit 42)

Lead DFIR consultant delivering expert incident response and digital forensics services to clients, guiding investigations and providing actionable remediation guidance across enterprise environments.

• Lead and execute digital forensics and incident response investigations across enterprise environments
• Serve as a technical lead on incident response engagements
• Conduct advanced host, network, and cloud investigations
• Perform forensic acquisition and analysis of systems, memory, logs, and endpoint telemetry
• Provide clear technical findings and remediation guidance

Hands-on DFIR tooling (EnCase, FTK, SleuthKit, Volatility) across Windows/Linux/macOS; experience with MITRE ATT&CK and enterprise incident response; strong client-facing and mentorship capabilities.

The ideal candidate is a lead DFIR professional with 6+ years of incident response and digital forensics experience, able to lead complex investigations, guide clients, and mentor junior staff. They should be proficient with common DFIR tools and MITRE ATT&CK-aligned methodologies, and comfortable working remotely with client-facing engagements.

Required