Investigator / AI Developer | Remote, Client Travel as Needed
About The Position
The Investigator / AI Developer conducts complex digital forensic investigations and incident response engagements while building tools and AI-enabled workflows that improve investigative speed, quality, and consistency. The role involves host and network forensics, memory forensics, malware triage, encrypted artifact recovery, anti-forensics detection, log analysis, threat hunting, and identifying attacker tactics, techniques, and procedures across cloud, OT, and enterprise environments. The position also develops indicators of compromise and defensible attack timelines. The role designs and builds investigation tools, automation scripts, and data products. It converts repeatable processes into functional prototypes using AI-assisted development, low-code platforms, and data visualization or development technologies such as Power BI, Azure Data Services, and Python. Generative AI and AI coding assistants are expected to be used fluently as development accelerators. The investigator documents, versions, supports, and iterates on tools based on engagement feedback, collaborating with senior practitioners to identify opportunities to improve service delivery. The position also interfaces with client stakeholders and legal counsel, authors defensible written reports, presents technical findings and tool outputs to clients, and supports leadership in engagement scoping. This is a primarily remote, full-time W-2 opportunity with travel as required by client and project needs. Sponsorship is not available.
Requirements
- Bachelor’s degree or equivalent work experience.
- At least 3 years of experience in DFIR, with demonstrated expertise in complex investigations.
- At least 3 years of experience in cybersecurity consulting and data-oriented development or analysis.
- At least 3 years of experience building tools used by others in professional practice.
- At least 3 years of demonstrated experience with at least one data or development layer: Python, PowerShell, Power BI, Power Apps/Automate, SQL, or a comparable stack.
- At least 3 years of demonstrated experience with common DFIR toolsets such as Volatility, X-Ways, FTK, EnCase, or Autopsy.
- At least 3 years of demonstrated experience with Microsoft Windows, GNU/Linux, and MacOS operating systems.
- At least 3 years of demonstrated experience in memory forensics.
- At least 3 years of demonstrated experience in enterprise environments, Active Directory, and common attack patterns.
- At least 3 years of demonstrated experience in endpoint and network threat hunting.
- At least 3 years of demonstrated experience with recognized incident response lifecycles and frameworks such as SANS, NIST, or MITRE.
- At least 3 years of demonstrated experience producing accurate, defensible, well-documented analysis.
- At least 1 year of demonstrated experience using AI coding assistants and generative tools fluently in everyday development work.
- At least 1 year of demonstrated experience with Azure and cloud-native architectures, and comfort using AI as a development accelerator.
- Must be open and able to travel based on client and project requirements.
- Sponsorship is not available.
Nice To Haves
- Experience with cloud forensics across AWS, Azure, and GCP; OT/ICS experience is a plus.
- Malware analysis capabilities, including unpacking, deobfuscation, behavior analysis, and reverse engineering.
- Experience with AI governance, responsible-use frameworks, or tool validation in security or consulting.
Responsibilities
- Conduct complex forensic investigations, including advanced memory forensics, malware triage, encrypted artifact recovery, and anti-forensics detection.
- Perform host and network digital forensics, log analysis, and threat hunting for incident response engagements.
- Use EDR solutions, cloud platforms, and threat intelligence to identify and document attacker TTPs.
- Participate in incident response across cloud, OT, and traditional enterprise environments.
- Develop indicators of compromise and comprehensive, defensible attack timelines.
- Design and build proprietary investigation tools, automation scripts, and data products to accelerate forensic workflows and improve consistency.
- Translate repeatable investigation processes into functional prototypes using AI-assisted development, low-code platforms, data visualization, and development tools.
- Use generative AI and AI coding assistants fluently to reduce manual effort across triage, analysis, and reporting.
- Govern tools through documentation, version control, onboarding guides, and iteration based on engagement feedback.
- Collaborate with senior practitioners to identify tooling improvements to speed, quality, and scalability.
- Interface with client stakeholders and legal counsel throughout engagements.
- Author comprehensive, defensible written reports on investigative findings.
- Present technical findings and tool outputs on client calls.
- Support leadership in scoping engagements with methodical, innovative approaches.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
