Principal DFIR Consultant
New
G
GuidePoint SecurityCybersecurity Consulting
Anywhere in the U.S.Full-TimePrincipal
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Experience
- 8+ years of hands-on DFIR experience, 10+ combined years of IT and information security experience.
- Required Skills
- PythonCybersecurity
Requirements
- 8+ years of hands-on DFIR experience including complex incident response and forensics.
- 10+ combined years of IT and information security experience.
- Demonstrated experience in a Lead or senior technical role on high-severity engagements.
- Expert-level proficiency in host forensics, network forensics, log analysis, malware triage, and cloud IR.
- Exceptional written and verbal communication skills for executive and legal audiences.
- Proven track record of mentoring and developing technical staff.
- Experience developing or contributing to DFIR methodologies, playbooks, or tooling.
- Proficiency with scripting languages like PowerShell, Python, Bash, or Go.
- Experience with EDR, NDR, XDR, SIEM, Velociraptor, and forensic platforms.
- Experience with cloud incident response (AWS, Azure, Microsoft 365, Google Workspace).
- Relevant certifications such as GREM, GCFA, GCFE, GDAT, GCIH, GCIA, or CISSP.
Responsibilities
- Serve as the oversight lead on complex or high-severity engagements, ensuring quality analysis and deliverables.
- Lead critical investigations involving ransomware, APT, nation-state threats, or insider threats.
- Perform advanced host and network forensics, malware triage, and cloud incident response.
- Design and maintain DFIR investigation methodologies, playbooks, and SOPs.
- Mentor Senior Consultants and Analysts and provide technical guidance.
- Develop automation, scripts, and integrations to improve investigative efficiency.
- Support pre-sales, scoping, and proposal development for DFIR and advisory engagements.
- Represent the company externally via conferences, publications, and community engagement.
View Full Description & ApplyYou'll be redirected to the employer's site
