Principal DFIR Consultant – Remote

About the role

PNG Cyber is seeking a Principal DFIR Consultant to lead high‑stakes digital forensics and incident response engagements. Working remotely, you will act as the primary liaison for clients, guiding investigations from initial scoping through final reporting.

Key responsibilities

• Serve as the main point of contact for clients, legal counsel, and stakeholders throughout the case lifecycle.
• Conduct detailed scoping calls, gather requirements, and draft precise Statements of Work.
• Oversee multiple simultaneous engagements, ensuring they stay on schedule, within scope, and meet quality standards.
• Lead a team of analysts, providing mentorship, quality control, and technical guidance.
• Perform forensic analysis using tools such as Axiom, X‑Ways, Splunk, and other commercial or open‑source IR solutions.
• Negotiate with threat actors during active ransomware incidents and communicate findings to technical and non‑technical audiences.
• Produce client‑ready reports with a focus on accuracy, clarity, and professionalism.

Required profile

• Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Information Security, Digital Forensics, or a related field (preferred).
• 5+ years of experience leading DFIR engagements with direct client interaction.
• Deep knowledge of incident response, digital forensics methodologies, ransomware, BEC, and threat‑actor tactics.
• Strong customer‑service orientation and ability to translate technical details into actionable information.
• Proven ability to manage teams, set priorities, and maintain quality across multiple high‑stakes projects.
• Excellent verbal and written communication skills, especially in drafting technical reports.

Required skills

• Axiom
• X‑Ways
• Splunk