Cyber Consultant, DFIR

Level Blue•Washington, DC

3d•Hybrid

About The Position

LevelBlue is seeking a highly skilled and motivated Digital Forensics and Incident Response (DFIR) Specialist to join its global DFIR team. The role involves investigating and responding to cybersecurity incidents, conducting digital forensic investigations, and serving as the primary client contact during engagements. The specialist will work independently to meet engagement milestones across forensics, log analysis, and report writing, delivering efficiently against client deadlines. The role requires technical expertise, analytical ability, and strong client communication. The specialist will lead incident response activities, investigate breaches and their impacts, collect and analyze digital evidence, and produce clear reports that explain incidents to non-technical audiences. They will collaborate with internal LevelBlue teams and external client stakeholders, including IT, legal, compliance, and vendors. Candidates able to work from the New York, Washington, DC, or Chicago office are strongly preferred. The position supports flexible work, with in-person collaboration for key moments based on role, team, and business needs.

Requirements

Proven experience in digital forensics and incident response (DFIR).
Knowledge of digital forensics tools and techniques, including X-Ways or similar forensic tooling.
Experience with incident response frameworks and methodologies such as NIST or SANS.
Excellent analytical and problem-solving skills.
Strong understanding of network protocols, operating systems, and security technologies.
Excellent written and verbal communication skills.
Experience and interest in interfacing with clients or customers.
Ability to work independently and manage multiple projects simultaneously.
High school diploma or equivalent required.
Legally authorized to work in the United States.
Flexibility to support occasional travel and work outside standard business hours, including evenings and weekends, as required; participation in an on-call schedule is also required.

Nice To Haves

Bachelor’s or master’s degree in Digital Forensics, a computer science-focused field, or a closely related field of study and expertise.
DFIR industry-accepted certifications.
Knowledge of scripting languages such as Python or PowerShell for automation and analysis.
Knowledge of database formats for investigative and knowledge purposes.
Knowledge of Azure, AWS, Oracle, and/or GWP.

Responsibilities

Lead and coordinate client-facing responses to cybersecurity incidents, including identification, containment, eradication, and recovery.
Analyze and investigate security breaches to determine their root cause and impact.
Conduct digital forensic investigations involving servers, end-user workstations, network systems, and SaaS platforms containing relevant artifacts, logs, or data.
Collect, preserve, and analyze digital evidence in accordance with legal and regulatory requirements.
Prepare detailed incident reports that explain the incident narrative and findings for non-technical audiences.
Maintain accurate and thorough documentation of incident response activities and forensic investigations.
Collaborate internally with DFIR, Advisory, Testing, Threat Intelligence, MDR/MSS, and other LevelBlue teams.
Work with client IT, legal, compliance, and vendor teams to support engagement delivery and guide clients through investigations and containment.
Communicate updates to stakeholders and ensure alignment with incident response processes.
Support occasional travel and work outside standard business hours, including evenings and weekends, as required, and participate in an on-call schedule.