Incident Commander, Digital Forensics & Incident Response

BlueVoyant•Remote, US,

1d•Remote

About The Position

BlueVoyant is seeking an Incident Commander for Digital Forensics & Incident Response to lead high-impact cyber investigations and take command of complex, high-pressure security incidents. This is a senior, client-facing individual contributor role with no direct reports. The Incident Commander guides organizations from initial response through investigation, containment, and recovery, advising executives, legal counsel, and technical teams. The role leads end-to-end DFIR engagements involving ransomware, business email compromise, cloud and identity compromise, insider threats, and advanced attacks. It includes performing and directing forensic analysis across endpoint, cloud, identity, SaaS, email, and network environments; translating technical findings into business risk and remediation guidance; and leading executive briefings, client updates, and post-incident reviews. The Incident Commander also manages multiple concurrent incidents, coordinates assigned consultants and analysts, shares expertise through informal coaching, and supports incident readiness, tabletop exercises, and client growth initiatives. The position is remote in the United States and requires U.S. citizenship. A bachelor's degree in a relevant field or equivalent professional experience is preferred. BlueVoyant describes itself as an AI-driven cybersecurity company that combines human, artificial, and proprietary intelligence to protect organizations from cyber threats. It offers competitive compensation and a comprehensive benefits package, with support for wellbeing, development, and career growth.

Requirements

3–5 years of hands-on DFIR experience in real-world incidents.
6–10 years in client-facing consulting, incident response, or cyber advisory roles.
Proven experience as an incident commander or senior DFIR lead.
Strong background in ransomware, cloud and identity compromise, and complex attack investigations.
Experience working directly with executives, legal counsel, insurers, and technical teams.
Ability to manage multiple stakeholders, workstreams, and timelines under pressure.
Strong knowledge of endpoint, cloud, identity, SaaS, and network forensics.
Experience with tools such as EnCase, FTK, Magnet AXIOM, Velociraptor, Splunk, Sentinel, and CrowdStrike, or similar tools.
Familiarity with Microsoft 365, Entra ID, Azure, AWS, Okta, and Google Workspace.
Understanding of attacker tradecraft, including persistence, lateral movement, and data exfiltration.
Working knowledge of KQL, SPL, SQL, PowerShell, Python, or Bash.
Exceptional communication skills, including the ability to translate technical issues into business impact.
Strong judgment and composure in high-stress, ambiguous environments.
Collaborative, client-focused approach emphasizing quality and outcomes.
U.S. citizenship is required for work on some federal contracts; the posting also states that U.S. citizenship is required for this position.
Bachelor's degree preferred in Cybersecurity, Computer Science, DFIR, or a related field, or equivalent professional experience.

Nice To Haves

Experience working with breach counsel, insurers, or regulators.
Incident readiness, tabletop, or incident response planning experience.
Certifications such as CISSP, GCFA, GCIH, GCFE, GNFA, or OSCP.

Responsibilities

Act as incident commander for complex DFIR engagements from beginning to end.
Serve as the primary client lead, advising executives, legal counsel, insurers, and other stakeholders.
Lead investigations involving ransomware, BEC, cloud or identity compromise, insider threats, and advanced attacks.
Perform and direct forensic analysis across endpoint, cloud, identity, SaaS, email, and network environments.
Translate technical findings into clear business-risk and remediation guidance.
Lead executive briefings, client updates, and post-incident reviews.
Manage multiple concurrent incidents in fast-paced, high-pressure environments.
Coordinate the work of DFIR consultants and analysts assigned to engagements, and share expertise through informal coaching and knowledge sharing.
Support incident readiness, tabletop exercises, and client growth initiatives.