Sr. Consultant, DFIR
About The Position
LevelBlue is seeking a Digital Forensics and Incident Response (DFIR) Specialist for its Global LevelBlue DFIR team. The role investigates and responds to cybersecurity incidents, conducts forensic investigations, and serves as the primary client contact. The successful candidate will independently manage engagement milestones across forensics, log analysis, and report writing, delivering efficiently against client deadlines. The position includes leading client-facing incident response, investigating breaches to determine their root cause and impact, and examining evidence from servers, end-user workstations, network systems, and SaaS platforms. The consultant documents investigative activities and prepares detailed reports that explain the incident clearly to non-technical audiences. The role collaborates with LevelBlue service teams and client stakeholders, and includes occasional travel, work outside standard business hours, and participation in an on-call schedule.
Requirements
- Proven experience in digital forensics and incident response (DFIR).
- Strong knowledge of digital forensics tools and techniques, including X-Ways or similar forensic tooling.
- Experience with incident response frameworks and methodologies such as NIST or SANS.
- Excellent analytical and problem-solving skills.
- Strong understanding of network protocols, operating systems, and security technologies.
- Excellent written and verbal communication skills.
- Experience and interest in interfacing with clients or customers.
- Ability to work independently and manage multiple projects simultaneously.
- High school diploma or equivalent.
- Legally authorized to work in the United States.
Nice To Haves
- Bachelor's or master's degree in Digital Forensics, a computer science-focused field, or a closely related field of study and expertise.
- Industry-accepted DFIR certifications.
- Knowledge of scripting languages such as Python or PowerShell for automation and analysis.
- Knowledge of database formats for investigative and knowledge purposes.
- Knowledge of Azure, AWS, Oracle, and/or GWP cloud platforms.
Responsibilities
- Lead and coordinate client-facing responses to cybersecurity incidents, including identification, containment, eradication, and recovery.
- Analyze security breaches to determine root cause and impact.
- Conduct digital forensic investigations of servers, end-user workstations, network systems, and SaaS platforms containing relevant artifacts, logs, or data.
- Collect, preserve, and analyze digital evidence in accordance with legal and regulatory requirements.
- Prepare detailed incident reports that explain the incident for non-technical audiences rather than merely restating dates and times.
- Maintain accurate and thorough documentation of incident response activities and forensic investigations.
- Collaborate internally with DFIR, Advisory, Testing, Threat Intelligence, MDR/MSS, and other LevelBlue services teams.
- Work with client IT, legal, compliance, and external vendor teams, serving as the primary contact to guide clients through investigations and containment.
- Communicate updates to stakeholders and ensure alignment with incident response processes.
- Support occasional travel, work outside standard business hours as required, and participate in an on-call schedule.
Benefits
- Comprehensive medical insurance.
- Dental insurance.
- Vision insurance.
- 401(k) with employer matching.
- Generous paid time off and holidays.
- Flexible spending accounts and health savings accounts.
- Employee assistance programs.
- Training and development opportunities.
- Adoption assistance program.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
High school or GED
