Cyber Defense DFIR Manager

NorthMark Strategies • Dallas, TX

1d

About The Position

NorthMark Strategies is hiring a Cyber Defense DFIR Manager within the Office of the CISO. Reporting to the Director of Cyber Defense, this role owns incident response and digital forensics as a dedicated discipline within the cyber defense function. The manager will maintain and continuously improve the enterprise incident response program and entity-specific playbooks across NorthMark Strategies’ operating companies, which span quantitative research, banking, motorsport, and advanced technology ventures. Foundational elements of the DFIR function are already in place; the manager will build on and operationalize them, strengthen forensic standards and tooling, grow incident response capability and team capacity, and lead exercises that test readiness across the ecosystem.

The role combines hands-on forensic investigations with program leadership and incident command. Investigations may involve host, network, cloud—including AWS, Azure, and Kubernetes—mobile, memory, and Microsoft 365/Entra evidence, as well as security incidents, insider risk cases, and legal or HR matters. The manager will establish defensible evidence-handling practices, maintain forensic infrastructure, support legal hold and eDiscovery processes, and produce findings suitable for legal and regulatory use. They will coordinate significant incident responses, partner with cyber defense and other organizational stakeholders, and develop a team of incident response and forensics professionals.

The position requires a bachelor’s degree in a relevant field or equivalent experience, at least seven years of progressive relevant experience, and at least three years directly managing or mentoring incident response or forensics professionals. The successful candidate must be legally authorized to work in the United States without current or future employer sponsorship. NorthMark Strategies describes its environment as dynamic and values Integrity, Ability, and Energy.

Requirements

• Bachelor’s degree in Computer Science, Information Security, or a related field; equivalent experience may be considered instead of a degree.
• At least 7 years of progressive experience in incident response, digital forensics, or security operations, including direct experience maintaining incident response plans or playbooks.
• At least 3 years of direct experience managing or mentoring incident response or forensics professionals, including performance development, workload prioritization, and on-call rostering.
• Hands-on digital forensics experience across disk, memory, network, and cloud evidence, including timeline reconstruction and malware or triage analysis.
• Experience with mobile device forensics, including iOS and Android acquisition and analysis.
• Experience with cloud-native forensics across AWS, Azure, and containerized or Kubernetes environments.
• Experience with Microsoft 365/Entra-native forensic investigations, including Purview eDiscovery and Content Search, Unified Audit Log analysis, and Graph API-based evidence collection.
• Experience producing forensic reports and documentation suitable for legal or regulatory proceedings, including litigation support or expert-witness readiness.
• Experience building or maintaining forensic lab infrastructure, including write-blockers, forensic workstations, secure evidence storage, and chain-of-custody systems.
• Demonstrated experience designing, organizing, and running tabletop exercises or incident response simulations.
• Experience operationalizing or maturing an existing incident response or DFIR function, including evolving tooling, workflows, and standards.
• Experience building or maturing legal hold and eDiscovery processes, including preservation notices, custodian tracking, and defensible collection.
• Working knowledge of the Microsoft security ecosystem, including Sentinel, the Defender suite, and Entra ID; proficiency with KQL, Python, or PowerShell.
• Experience with forensic and incident response tools such as Magnet AXIOM, Magnet Nexus, X-Ways Forensics, and Magnet Verakey, and with EDR-integrated forensic workflows.
• Strong command of incident response and forensic frameworks, including NIST SP 800-61 and MITRE ATT&CK, and experience operationalizing threat intelligence in response work.
• Exceptional written and verbal communication skills; ability to lead calmly and clearly during live incidents and communicate findings to technical and non-technical stakeholders.
• High personal integrity and the ability to handle confidential and sensitive matters professionally.
• Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future.

Nice To Haves

• Experience building or maturing legal hold and eDiscovery processes across a multi-entity environment.
• Experience operating in multi-tenant, multi-entity, or MSSP-like environments.
• Possession of, or ability to obtain, certifications such as GCFE, GCFA, GNFA, GREM, EnCE, CHFI, or CISSP.

Responsibilities

• Maintain and continuously update the enterprise incident response plan and entity-specific playbooks, accounting for each entity’s regulatory and operational context.
• Operationalize and mature the DFIR function by strengthening tooling, workflows, evidence-handling standards, operational metrics, incident response maturity, and team capacity.
• Lead forensic investigations across host, network, cloud, mobile, and memory evidence for security incidents, insider risk cases, and legal or HR matters.
• Establish and enforce defensible chain-of-custody and evidence-handling practices.
• Lead forensic investigations within Microsoft 365 and Entra, including Unified Audit Log analysis, Purview eDiscovery and Content Search, and Graph API-based evidence collection.
• Produce clear, defensible forensic findings and reports for legal, regulatory, and potential litigation use, and support declarations or expert-witness needs as required.
• Build and maintain forensic lab and evidence-handling infrastructure, including write-blockers, forensic workstations, secure evidence storage, and hashing and validation procedures.
• Mature legal hold and eDiscovery processes with Legal, including preservation notices, defensible identification and collection, custodian tracking, and chain-of-custody.
• Serve as incident commander or deputy for significant incidents, coordinating response across IT, Legal, HR, and entity leadership.
• Lead post-incident reviews and root cause analyses, and track corrective actions through closure.
• Design, organize, and run tabletop exercises and simulations; own the exercise calendar and after-action reporting.
• Partner with entity leadership and IT to maintain consistent readiness across the multi-entity ecosystem while adapting plans to entity-specific requirements, including those of a federally regulated banking entity.
• Work with SIEM/detection engineering and other cyber defense functions to ensure effective handoffs from detection to investigation and response, and feed forensic findings into detection priorities.
• Evaluate and adopt AI and automation to accelerate forensic triage, evidence correlation, and timeline reconstruction in alignment with the organization’s agentic cyber defense direction.
• Incorporate relevant indicators of compromise, tactics, techniques, procedures, and adversary tradecraft into playbooks and forensic methodology.
• Report on incident response posture, exercise outcomes, and DFIR metrics to the Director of Cyber Defense and other stakeholders; support audits, examinations, and legal matters.
• Build, manage, and develop an incident response and forensics team, including hiring, performance development, workload prioritization, on-call rostering, and casework quality.

Benefits

• Company-paid lunch stipend through GrubHub.
• 100% employer-paid medical coverage in the High-Deductible Health Plan, plus dental and vision benefits for employees and their families.
• 16 weeks of paid parental leave.
• Employee Assistance Program.
• Life insurance, short-term disability, and long-term disability.
• 401(k) match of 100% of employee contributions up to 6%.
• Optional employee-paid PPO medical insurance and other benefits, including Health Savings Accounts with a company contribution, Flexible Spending Accounts, supplemental life insurance, and Wellhub.
• 25 days of paid time off plus 12 company holidays.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager