Cyber Consultant, DFIR

LevelBlue LLC•Washington, DC

4d•$90,000 - $125,000

About The Position

LevelBlue is seeking a Digital Forensics and Incident Response (DFIR) Specialist for its Global DFIR team. The role investigates and responds to cybersecurity incidents, conducts forensic investigations, and serves as the primary client contact. The specialist is expected to work independently toward engagement milestones spanning forensics, log analysis, and report writing, while meeting client deadlines efficiently. The position requires deep technical expertise, analytical ability, and strong communication skills. It includes leading client-facing incident response, investigating security breaches and their causes and impacts, collecting and analyzing evidence, and producing clear reports for non-technical audiences. The role collaborates with internal LevelBlue teams and client stakeholders, including IT, legal, compliance, and external vendors. Candidates legally authorized to work in the United States may apply. LevelBlue supports flexible work and brings employees together in person for key moments based on role, team, and business needs. There is a very strong preference for candidates able to work from the New York, Washington, DC, or Chicago office.

Requirements

Proven experience in digital forensics and incident response (DFIR).
Strong knowledge of digital forensics tools and techniques, including X-Ways or similar forensic tooling.
Experience with incident response frameworks and methodologies such as NIST, SANS, or similar.
Excellent analytical and problem-solving skills.
Strong understanding of network protocols, operating systems, and security technologies.
Excellent written and verbal communication skills.
Experience and interest in interfacing with clients or customers.
Ability to work independently and manage multiple projects simultaneously.
Flexibility to support occasional travel and work outside standard business hours, including evenings and weekends, as required.
Ability to participate in an on-call schedule.
High school diploma or equivalent.

Nice To Haves

Bachelor's or master's degree in Digital Forensics, a computer science-focused field, or a closely related field of study and expertise.
Industry-accepted DFIR certifications.
Knowledge of scripting languages such as Python or PowerShell for automation and analysis.
Knowledge of database formats for investigative and knowledge purposes.
Knowledge of Azure, AWS, Oracle, and/or GWP cloud platforms.

Responsibilities

Lead and coordinate client-facing responses to cybersecurity incidents, including identification, containment, eradication, and recovery.
Analyze and investigate security breaches to determine root cause and impact.
Conduct digital forensic investigations across servers, end-user workstations, network systems, and SaaS platforms containing relevant artifacts, logs, or data.
Collect, preserve, and analyze digital evidence in accordance with legal and regulatory requirements.
Prepare detailed incident reports that explain the incident clearly for non-technical audiences, rather than merely restating dates and times.
Maintain accurate and thorough documentation of incident response activities and forensic investigations.
Collaborate internally with DFIR, Advisory, Testing, Threat Intelligence, MDR/MSS, and other LevelBlue services teams.
Work with client IT, legal, compliance, and external vendor teams to support engagements and guide clients through forensic investigations and incident containment.
Communicate updates to stakeholders and ensure alignment with incident response processes.
Provide occasional travel and support outside standard business hours, including evenings and weekends, as required; participate in an on-call schedule.