Principal DFIR Consultant – Remote

About the role

As a Principal DFIR Consultant you will provide senior‑level technical expertise in digital forensics and incident response while acting as the main liaison for clients throughout the case lifecycle. The role is fully remote and involves leading investigations into ransomware, business email compromise, insider threats and other cyber incidents.

Key responsibilities

• Serve as the primary point of contact for clients, legal counsel and stakeholders from intake to final reporting.
• Conduct scoping calls, gather requirements and draft precise Statements of Work.
• Oversee multiple simultaneous engagements, ensuring they stay on schedule and within scope.
• Direct, mentor and perform quality control for a team of analysts and consultants.
• Execute forensic analysis using tools such as Axiom, X‑Ways and Splunk, leading investigations into ransomware, BEC and other incidents.
• Communicate technical findings clearly to both technical and non‑technical audiences, including on‑camera briefings.
• Produce client‑ready reports with a focus on accuracy and clarity.
• Contribute to the development of modern forensic techniques, tools and best practices.
• Maintain high availability during active engagements, including non‑traditional hours.

Required profile

• Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Information Security, Digital Forensics or a related field (preferred).
• 5+ years of experience leading digital forensics and incident response engagements with direct client interaction.
• Deep knowledge of incident response, digital forensics methodologies, ransomware investigations and threat‑actor tactics.
• Strong customer‑service orientation and ability to translate technical details into actionable information.
• Proven ability to manage teams, set priorities and maintain quality control across high‑stakes projects.
• Excellent verbal and written communication skills, with a track record of drafting professional technical reports.
• Relevant certifications such as GCFE, GCFA, GCIH, GNFA, GREM, CISSP are strongly preferred.

Required skills

• Axiom
• X‑Ways
• Splunk