Sr. Incident Examiner/Negotiator, DFIR

LevelBlue LLC

1d•$130,000 - $195,000•Remote

About The Position

LevelBlue is seeking a skilled Digital Forensics and Incident Response (DFIR) practitioner for its Global LevelBlue DFIR team. The role investigates and responds to cybersecurity incidents, conducts forensic investigations and log analysis, and produces reports while independently managing work against engagement milestones. It also conducts threat actor communications and ransomware or extortion negotiations when required as part of DFIR engagements. The practitioner needs deep technical expertise, strong analytical and communication skills, sound judgment, and the ability to work effectively under pressure during fast-moving, high-stakes incidents. The role requires availability for team on-call scheduling and time-sensitive communications during active ransomware or extortion incidents, potentially across time zones and outside normal business hours. The position includes cloud and identity forensics, incident reporting, and collaboration with internal LevelBlue teams and client stakeholders. It is open to candidates legally authorized to work in the United States. LevelBlue supports flexible work and brings people together in person for key moments based on role, team, and business needs.

Requirements

Strong knowledge of digital forensics tools and techniques, including X-Ways or similar forensic tooling.
Experience with incident response frameworks and methodologies such as NIST or SANS.
Excellent analytical and problem-solving skills.
Strong understanding of network protocols, operating systems, and security technologies.
Excellent written and verbal communication skills.
Ability to work independently and manage multiple projects simultaneously.
Demonstrated experience conducting or materially supporting threat actor communications, ransomware negotiations, cyber extortion negotiations, crisis negotiations, or comparable high-stakes adversarial communications.
Ability to communicate calmly and deliberately under pressure and distinguish investigative facts, threat actor claims, assumptions, and negotiation positions.
Understanding of ransomware and data-extortion ecosystems, common threat actor communication methods, leak sites, negotiation portals, cryptocurrency-related settlement workflows, and ransomware response considerations.
Experience using threat intelligence and prior threat actor behavior to support attribution assessment, credibility analysis, negotiation planning, and client risk decisions.
Strong written documentation skills for contemporaneous communication logs, negotiation summaries, decision records, and stakeholder updates.

Nice To Haves

Bachelor's or master's degree in Digital Forensics, a Computer Science-focused field, or a closely related field of study and expertise.
DFIR certifications.
Knowledge of scripting languages such as Python or PowerShell for automation and analysis.
Knowledge of database formats for investigative and knowledge purposes.
Prior law enforcement and/or crisis negotiation experience.
Formal training or demonstrated experience in crisis negotiation, ransomware negotiation, behavioral analysis, threat intelligence, HUMINT, or adversarial communications.
Experience coordinating ransomware or extortion matters with breach counsel, cyber insurers, law enforcement, payment or settlement providers, and executive stakeholders.

Responsibilities

Lead and coordinate cybersecurity incident responses, including identification, containment, eradication, and recovery.
Investigate security breaches to determine root cause and impact.
Conduct forensic investigations across servers, end-user workstations, network systems, and SaaS platforms containing relevant artifacts, logs, or data.
Collect, preserve, and analyze digital evidence in accordance with legal and regulatory requirements.
Remain available for time-sensitive communications during active ransomware or extortion incidents, including outside normal business hours and across time zones.
Conduct controlled communications with ransomware and extortion threat actors on behalf of clients, coordinating with engagement leadership, breach counsel, insurers, and other authorized stakeholders.
Develop and execute communication and negotiation strategies based on client objectives, operational impact, legal guidance, incident facts, threat actor behavior, and threat intelligence.
Establish and maintain secure threat actor communication channels and complete records of communications, demands, representations, deadlines, and negotiation activity.
Assess threat actor identity, credibility, behavior, historical patterns, and claims of compromise or exfiltration to inform negotiation strategy and client decisions.
Manage communication cadence, tone, sequencing, and content to obtain information, validate claims, preserve options, manage time, and limit unnecessary disclosure.
Support ransomware and extortion negotiations, including demand assessment, counteroffers, time extensions, proof requests, data deletion or non-publication representations, decryptor validation coordination, and authorized settlement-related communications.
Brief client leadership, counsel, insurers, and the DFIR engagement team on threat actor communications, negotiation posture, risks, decision points, and recommended actions.
Coordinate threat actor communications with DFIR investigations so negotiation information informs forensic analysis, scoping, containment, threat intelligence, and recovery, and technical findings inform negotiation strategy.
Maintain confidentiality, professional ethics, independence, and need-to-know handling of sensitive client and negotiation information.
Analyze cloud environments, including Azure, AWS, GCP, and Oracle, for identity abuse, privilege escalation, persistence, and lateral movement.
Analyze cloud-specific indicators of compromise and tactics, techniques, and procedures; identify misuse of APIs, service principals, roles, and OAuth applications.
Investigate identity and access compromises involving IAM roles, Azure AD/Entra ID identities, service accounts, and federated access.
Analyze authentication patterns such as impossible travel, token abuse, and anomalous API usage, and assess privilege escalation paths and access persistence mechanisms.
Prepare detailed incident reports that explain the incident narrative for non-technical audiences, rather than merely restating dates and times.
Maintain accurate and thorough documentation of incident response activities and forensic investigations.
Work with internal cross-functional teams, including DFIR, Advisory, Testing, Threat Intelligence, and MDR/MSS, and with client IT, legal, compliance, and external vendor teams.
Communicate effectively with stakeholders, provide updates, and support alignment with incident response processes.