Cyber Defense DFIR Manager

NorthMark Strategies•Dallas, TX

About The Position

The Cyber Defense DFIR Manager reports to the Director of Cyber Defense and works within the Office of the CISO. This role owns incident response and digital forensics as a dedicated discipline within cyber defense, maintaining and improving the incident response program and entity-specific playbooks across NorthMark Strategies’ ecosystem of operating companies, including quantitative research, banking, motorsport, and advanced technology ventures. Building on existing foundational capabilities, the manager will operationalize and mature the DFIR function by strengthening forensic standards and tooling, expanding incident response capability and team capacity, and designing and leading tabletop exercises and simulations. The role also serves as an incident command resource for significant incidents, partnering across cyber defense and with other functions to support the path from detection through investigation, containment, and recovery.

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related field; equivalent experience may be considered in lieu of a degree.
At least 7 years of progressive experience in incident response, digital forensics, or security operations, including direct experience maintaining incident response plans or playbooks.
At least 3 years of experience directly managing or mentoring incident response or forensics professionals, including performance development, workload prioritization, and on-call rostering.
Hands-on digital forensics experience across disk, memory, network, and cloud evidence, including timeline reconstruction and malware or triage analysis.
Experience with mobile device forensics, including iOS and Android acquisition and analysis.
Experience with cloud-native forensics across AWS, Azure, and containerized or Kubernetes environments.
Experience with Microsoft 365 and Entra-native forensic investigations, including Purview eDiscovery or Content Search, Unified Audit Log analysis, and Graph API-based evidence collection.
Experience producing forensic reports and documentation suitable for legal or regulatory proceedings, including litigation support or expert-witness readiness.
Experience building or maintaining forensic lab infrastructure, including write-blockers, forensic workstations, secure evidence storage, and chain-of-custody systems.
Demonstrated experience designing, organizing, and running tabletop exercises or incident response simulations.
Experience operationalizing or maturing an incident response or DFIR function, including evolving tooling, workflows, and standards within an existing program.
Experience building or maturing legal hold and eDiscovery processes, including preservation notices, custodian tracking, and defensible collection; multi-entity experience is desirable.
Working knowledge of the Microsoft security ecosystem, including Sentinel, the Defender suite, and Entra ID; proficiency with KQL, Python, or PowerShell.
Strong command of incident response and forensic frameworks, including NIST SP 800-61 and MITRE ATT&CK, and experience operationalizing threat intelligence in response work.
Exceptional written and verbal communication skills, including the ability to lead calmly during live incidents and convey findings to technical and non-technical stakeholders.
High personal integrity and ability to handle confidential and sensitive matters professionally.
Must be legally authorized to work in the United States without employer sponsorship, now or at any time in the future.

Nice To Haves

Experience operating in multi-tenant, multi-entity, or MSSP-like environments.
Possession of, or ability to obtain, professional certifications such as GCFE, GCFA, GNFA, GREM, EnCE, CHFI, or CISSP.
Experience with forensic and incident response tools such as Magnet AXIOM, Magnet Nexus, X-Ways Forensics, and Magnet Verakey, and with EDR-integrated forensic workflows.

Responsibilities

Maintain and continuously update the enterprise incident response plan and entity-specific playbooks, keeping them actionable and reflective of each entity’s regulatory and operational context.
Operationalize and mature the DFIR function by improving tooling, workflows, evidence-handling standards, operational metrics, response maturity, and team capacity.
Lead forensic investigations across host, network, cloud, mobile, and memory evidence for security incidents, insider risk cases, and legal or HR matters; establish defensible chain-of-custody and evidence-handling practices.
Lead forensic investigations within Microsoft 365 and Entra, including Unified Audit Log analysis, Purview eDiscovery and Content Search, and Graph API-based evidence collection.
Produce clear, defensible forensic findings and reports suitable for legal, regulatory, and potential litigation use, including declarations or expert-witness support as needed.
Build and maintain forensic lab and evidence-management infrastructure, including write-blockers, forensic workstations, secure evidence storage, and hashing and validation procedures.
Mature legal hold and eDiscovery processes across entities in partnership with Legal, including preservation notices, defensible identification and collection, custodian tracking, and chain-of-custody.
Serve as incident commander or deputy for significant incidents, coordinate response across IT, Legal, HR, and entity leadership, and lead post-incident reviews, root cause analysis, and corrective-action tracking.
Design, organize, and run tabletop exercises and simulations across the ecosystem; manage the exercise calendar and after-action reporting.
Partner with entity leadership and IT to maintain consistent incident response readiness while adapting plans to entity-specific regulatory and reporting obligations.
Work with SIEM/detection engineering and other cyber defense functions to support handoffs from detection to investigation and response and feed forensic findings into detection priorities.
Evaluate and adopt AI and automation to accelerate triage, evidence correlation, and timeline reconstruction in line with the organization’s agentic cyber defense direction.
Incorporate relevant indicators of compromise, tactics, techniques, procedures, and adversary tradecraft into playbooks and forensic methodology.
Report incident response posture, exercise outcomes, and DFIR metrics to the Director of Cyber Defense and other stakeholders; support audits, examinations, and legal matters.
Build, manage, and develop an incident response and forensics team, including hiring, performance development, workload and on-call rostering, and casework quality.

Benefits

Company-paid lunch stipend, with lunch provided via GrubHub.
100% employer-paid medical coverage in the High-Deductible Health Plan.
Dental and vision benefits for employees and their families.
16 weeks of paid parental leave.
Employee Assistance Program.
Life insurance.
Short-term and long-term disability coverage.
401(k) match of 100% of employee contributions up to 6%.
Optional employee-paid PPO medical insurance and other benefits, including Health Savings Accounts with a company contribution, Flexible Spending Accounts, supplemental life insurance, and Wellhub.
25 days of paid time off plus 12 company holidays.