Senior Digital Forensics and Incident Response (DFIR) Consultant

Cypfer • Phoenix, AZ

3d • Remote

About The Position

The Senior Consultant leads small workstreams within active incident response and recovery engagements, coordinating Consultants and ensuring deliverable quality and alignment with client objectives. Operating under the direction of a Manager or Senior Manager, the Senior Consultant owns workstream planning, validates technical outputs, and presents interim findings to client stakeholders while continuing to perform hands-on DFIR and post-breach recovery (PBR) tasks across insurance, legal, and enterprise client engagements. The role combines technical execution with emerging service-delivery leadership.

The position is remote and requires the ability to travel on short notice to client sites up to 50% of the time. Travel flexibility within 24–48 hours' notice is required for deployments typically lasting 1–2 weeks. The role also participates in a rotating on-call schedule and may require work on weekends and outside normal business hours.

Requirements

• 3–5+ years of experience in incident response, digital forensics, or a related cybersecurity role.
• Advanced DFIR and post-breach recovery analysis capability, including deeper forensic investigation and leading technical analysis workstreams.
• Ability to coordinate plans, tasks, and risks across an engagement workstream with multiple contributors while maintaining quality and alignment with client objectives.
• Experience presenting interim findings to client stakeholders, managing expectations, and leading the creation of client-ready deliverables.
• Basic scripting proficiency in Python and/or PowerShell to automate forensic or recovery tasks.
• Working knowledge of endpoint forensics, including evidence acquisition, preservation, and artefact triage across physical and virtual systems.
• Hands-on experience operating EDR platforms, such as CrowdStrike Falcon, for threat hunting, host isolation, and telemetry collection.
• Familiarity with SIEM, SOAR, or IR orchestration platforms.
• Ability to perform estimation and short-cycle planning within an engagement workstream.
• Strong customer service and consulting skills in client interactions.
• Ability to adhere to client and internal policies, procedures, and security practices.
• Ability to remain calm, composed, and articulate in high-pressure client situations.
• Excellent relationship management and communication skills.
• Ability to maintain a high level of confidentiality when accessing sensitive client and incident data.
• Ability to travel to client sites on short notice, up to 50%, and be flexible to travel within 24–48 hours' notice for deployments typically lasting 1–2 weeks.
• Ability to participate in a rotating on-call schedule and work weekends and outside normal business hours as needed.

Nice To Haves

• GCFA or GCFR certification is strongly preferred.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent hands-on experience.
• Industry certifications such as GCFA, GCFR, GCIH, CCFR, CCHF, AWS Certified, or similar.
• Exposure to threat hunting, network forensics, or malware analysis methodologies.
• Experience in a professional services or consulting environment.

Responsibilities

• Understand the client challenge and objectives, and ensure operational tasks across the workstream support the path to recovery.
• Lead small workstreams under the supervision of a Manager or Senior Manager; coordinate team task execution and ensure deliverable quality and alignment with client objectives.
• Own workstream planning, stand-ups, and risk tracking across active engagements.
• Validate technical outputs, present interim findings to client stakeholders, and manage expectations.
• Deliver discrete work packages, including forensic acquisition, IOC triage, and recovery steps.
• Maintain accurate case notes and produce client-ready artefacts while following SOPs and QA standards.
• Escalate risks early and follow chain-of-custody and compliance requirements.
• Analyze triage collections and artefacts for indicators of compromise (IoCs) and potentially malicious activity.
• Review logs from host systems and appliances to identify suspicious activity.
• Collect forensic disk and memory images from physical and virtual endpoints and servers.
• Drive event correlation and timeline construction across the engagement.
• Conduct independent threat research based on IOCs collected during investigations and direct junior team members in targeted research tasks.
• Participate in a rotating on-call schedule and work weekends or outside normal business hours as needed.
• Travel to client sites on short notice, with travel of up to 50% and deployments typically lasting 1–2 weeks.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed