DFIR Team Lead

Booz Allen Hamilton • McLean, VA

7d • $112,800 - $257,000 • Hybrid

About The Position

Lead and inspire a team of incident response analysts, fostering technical expertise, collaboration, and excellent client delivery. Lead incident response for major incidents and coordinate efforts to contain and resolve cybersecurity issues. Provide status updates to critical stakeholders, including Cybersecurity and Operations leaders and legal teams. Develop, maintain, and review incident documentation. Provide thought leadership for program improvements and new initiatives, and mentor junior team members to support continuous learning and excellence in Digital Forensics and Incident Response (DFIR).

The role is hybrid and based in McLean, Virginia. The position may require work after standard business hours, including evenings and weekends, and participation in an on-call rotation. The projected annual compensation range is $112,800 to $257,000.

Requirements

• At least 3 years of experience with digital forensics or incident response.
• Experience analyzing Microsoft Windows and non-Windows systems, including Mac or Linux, and using DFIR toolsets such as FTK, EnCase, XWF, and Axiom.
• Experience with scripted DFIR toolsets written in Python or PowerShell.
• Experience analyzing logs, including firewall, network traffic, IIS, antivirus, and DNS logs.
• Knowledge of common forensic artifacts used to determine attack vector, lateral movement, and data exfiltration.
• Ability to correlate events from multiple sources to create timeline analyses.
• Ability to organize case notes and communicate verbally and in writing to clients.
• Ability to prepare detailed technical reports.
• Ability to work after standard business hours, including evenings and weekends, and participate in an on-call rotation.
• High school diploma or GED.

Nice To Haves

• Experience forensically analyzing cloud data, including AWS, Azure, or GCP.
• Knowledge of mobile device platforms, including smartphones and tablets.
• Ability to prioritize work assignments without guidance.
• Bachelor’s degree preferred; master’s degree is a plus.
• DFIR or cybersecurity certification, including CCE, EnCE, CFCE, CISSP, CISM, GCIA, GCFE, GCFA, GREM, or GNFA.

Responsibilities

• Lead and inspire a team of incident response analysts.
• Lead incident response for major incidents and coordinate efforts to contain and resolve cybersecurity issues.
• Convey status updates to critical stakeholders, including Cybersecurity and Operations leaders and legal teams.
• Develop, maintain, and review critical documentation for incidents.
• Provide thought leadership for program improvements and new initiatives.
• Mentor junior team members and foster continuous learning and excellence in DFIR.

Benefits

• Health, life, disability, financial, and retirement benefits.
• Paid leave.
• Professional development.
• Tuition assistance.
• Work-life programs.
• Dependent care.
• Recognition awards for exceptional performance and demonstration of company values.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: High school or GED