PLAID ELITE DFIR Consultant

Seven AI•Boston, MA

About The Position

7AI is seeking a PLAID ELITE DFIR Consultant to join the DFIR team in Professional Services, part of PLAID ELITE. Reporting to the Head of DFIR, the consultant leads emergency incident response engagements from initial scoping through final reporting, delivering people-led, AI-driven forensics using the 7AI platform. The role combines hands-on investigation with improving investigative methods and technology. The consultant writes Velociraptor artifacts, builds platform skills, and validates AI-generated findings so that conclusions are timely, evidence-based, and defensible. The work spans client and counsel communication, enterprise investigations, evidence handling, mentoring analysts, and collaboration with Engineering and Product. The position participates in an on-call rotation for emergency response.

Requirements

At least 8 years of digital forensics and incident response experience, including leading client-facing engagements at a consultancy or IR firm.
A track record of leading emergency IR engagements directed by breach counsel and cyber insurance carriers, from scoping through delivery of findings to counsel.
Deep enterprise forensics expertise across host-based (Windows, macOS, Linux), network, cloud (AWS, Azure, GCP), SaaS (Microsoft 365, Google Workspace), and application evidence, including memory analysis and large-scale log correlation.
Hands-on Velociraptor experience, including writing VQL artifacts, and scripting experience in Python, PowerShell, or similar.
Working knowledge of malware analysis and experience querying SIEM and EDR data with KQL, SPL, FQL, or SQL.
Sound judgment in evaluating automated or AI-generated analysis, including knowing when to trust it, how to test it, and when to return to raw evidence.
Excellent written and verbal communication, including reports and briefings that executives, counsel, and engineers can act on.
A calm, decisive presence in a crisis, with the ability to run a scoping call, ransomware investigation, and counsel briefing in the same day, including while on call.

Nice To Haves

GIAC certifications (GCFA, GCFE, GNFA, GREM, GCIH) and/or CISSP.
Prior experience in a managed detection and response (MDR) environment.

Responsibilities

Conduct scoping calls with clients, breach counsel, and cyber insurance carriers to define engagement scope, objectives, and deliverables.
Manage engagements end to end, including investigation planning, collection coordination, timeline and budget tracking, and regular client and counsel updates.
Lead and personally perform enterprise investigations across host, network, cloud, SaaS, and application evidence, including ransomware, business email compromise, data theft, and intrusion matters.
Act as an escalation point for PLAID ELITE analysts needing forensic collection, malware analysis, or root-cause determination, and mentor them through investigations.
Collect and analyze evidence through the 7AI platform and Velociraptor, and write and maintain case-specific VQL artifacts.
Validate and test AiDFIR output by checking AI-driven findings against source evidence for accuracy, completeness, and risk; flag errors and uncertainty and apply expert human judgment to client-facing conclusions.
Build platform skills and develop tools that improve the speed, consistency, and quality of investigative workflows.
Own client- and counsel-facing deliverables, including interim updates, findings briefings, and final reports for executive, legal, and technical audiences.
Handle evidence to defensible standards, including chain of custody, and work within privilege as directed by counsel.
Feed engagement lessons learned into methodology, playbooks, and the platform.
Share field observations with Engineering and Product and help shape the 7AI platform and AiDFIR roadmap.
Participate in an on-call rotation to support emergency response.