Principal DFIR & Threat Intelligence Analyst

The Role

This role acts as the sole hands-on incident responder during weekend shifts, commanding high and critical security incidents end to end. Duties include host isolation, forensic artifact extraction from memory, cloud and container environments, malware analysis, and authoring breach-determination reports.

Skills & Experience

Requires expertise with forensic tools such as CrowdStrike Falcon Forensics, KAPE, Volatility, FTK Imager and Velociraptor, along with malware reverse engineering, YARA rule creation, and query languages including CQL, FQL, KQL and SQL across AWS security telemetry.

Who It Suits

Ideal for a highly experienced DFIR practitioner comfortable working independently during weekend coverage, who enjoys deep technical forensic investigation, incident command authority, and mentoring without people-management responsibilities.