DFIR Team Lead

What you'll do

• Lead a team of analysts to contain and resolve major cybersecurity incidents.
• Provide status updates to critical stakeholders including cybersecurity, operations, and legal leaders.
• Develop, maintain, and review critical documentation for all forensic incidents.
• Mentor junior team members and provide technical guidance in the DFIR domain.
• Analyze logs from firewalls, network traffic, IIS, antivirus, and DNS.
• Correlate events from multiple sources to create detailed timeline analyses.
• Prepare detailed technical reports and organize case notes for client communication.

What we're looking for

• High school diploma or GED.
• 3+ years of experience with digital forensics or incident response.
• Experience analyzing Windows, Mac, and Linux systems using toolsets like FTK, EnCase, XWF, and Axiom.
• Experience with scripted DFIR toolsets written in Python or PowerShell.
• Experience analyzing logs including firewall, network traffic, IIS, Antivirus, and DNS.
• Ability to correlate events from multiple sources to create a timeline analysis.
• Ability to work after standard business hours, including evenings and weekends, and take a rotation on call.
• Bachelor’s degree preferred; Master's degree a plus (preferred).
• DFIR or Cybersecurity Certification, including CCE, EnCE, CFCE, CISSP, CISM, GCIA, GCFE, GCFA, GREM, or GNFA (preferred).