Senior digital forensics and incident response (dfir) consultant

About the Role

The Senior Consultant leads small workstreams within active incident response and recovery engagements, coordinating Consultants and ensuring deliverable quality and alignment with client objectives. Operating under the direction of a Manager or Senior Manager, the Senior Consultant owns workstream planning, validates technical outputs, and presents interim findings to client stakeholders — while continuing to execute hands-on DFIR and PBR tasks across insurance, legal, and enterprise client engagements. The role sits at the intersection of technical execution and emerging service delivery leadership.

Core Responsibilities

• Understand the client challenge and objective; ensure operational tasks across the workstream are executed in line with the path to recovery.
• Lead small workstreams under the supervision of a Manager or Senior Manager; coordinate task execution across the team and ensure deliverable quality and alignment with client objectives.
• Own workstream planning, stand-ups, and risk tracking across active engagements.
• Validate technical outputs; present interim findings to client stakeholders and manage expectations.
• Deliver discrete work packages including forensic acquisition, IOC triage, and recovery steps.
• Maintain accurate case notes and produce client-ready artefacts; adhere to SOPs and QA standards throughout all engagements.
• Escalate risks early; follow chain-of-custody and compliance requirements at all times.
• Analyze triage collections and artefacts for indicators of compromise (IoCs) and potentially malicious activity.
• Review logs from host systems and appliances to identify suspicious activities.
• Collect forensic disk and memory images from physical and virtual endpoints and servers.
• Own and drive event correlation and timeline construction across the engagement.
• Conduct independent threat research based on IOCs collected during investigations, and direct junior team members in targeted research tasks.
• Participate in a rotating on-call schedule; ability to work on weekends and outside normal business hours as needed.
• This role is remote but requires the ability to travel on short notice to a client site up to 50%. Must maintain flexibility to travel within 24–48 hours' notice for deployments typically 1–2 weeks in duration.

Technical Requirements

• 3–5+ years of experience in incident response, digital forensics, or a related cybersecurity role.
• Advanced capability in DFIR and post-breach recovery analysis — able to perform deeper forensic investigation and lead technical analysis workstreams; GCFA or GCFR certification is strongly preferred.
• Demonstrated ability to coordinate plans, tasks, and risks across an engagement workstream with multiple contributors, maintaining quality and alignment with client objectives.
• Experience presenting interim findings to client stakeholders, managing expectations, and leading the creation of client-ready deliverables.
• Basic scripting proficiency in Python and/or PowerShell to automate forensic or recovery tasks.
• Working knowledge of endpoint forensics — evidence acquisition, preservation, and artefact triage across physical and virtual systems.
• Hands-on experience operating EDR platforms (e.g., CrowdStrike Falcon) for threat hunting, host isolation, and telemetry collection.
• Familiarity with SIEM, SOAR, or IR orchestration platforms.
• Ability to perform estimation and short-cycle planning within an engagement workstream.

Business Responsibilities

• Exhibit strong customer service and consulting skills in all client interactions.
• Adhere to client and internal policies, procedures, and security practices.
• Remain calm, composed, and articulate in high-pressure client situations.
• Exhibit excellent relationship management and communication skills.
• Ensure a high level of confidentiality due to having access to sensitive client and incident data.

Preferred Skills

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field — or equivalent hands-on experience.
• Industry certifications such as GCFA, GCFR, GCIH, CCFR, CCHF, AWS Certified or similar are a strong asset.
• Exposure to threat hunting, network forensics, or malware analysis methodologies.
• Experience in a professional services or consulting environment.