AD-DFIR

The Role

This leadership position oversees the full lifecycle of major security incidents, from ransomware and data exfiltration to cloud breaches. It involves directing forensic investigations across endpoints, servers and cloud platforms, reconstructing incident timelines, and producing detailed forensic reports for executives, legal teams and insurers.

Skills & Experience

Candidates need 10+ years in digital forensics, incident response or SOC leadership, including team management experience. Expertise spans disk and memory forensics tools (FTK, EnCase, Volatility, X-Ways), EDR/SIEM platforms, malware triage, cloud breach handling, and regulatory frameworks like CERT-In and DPDP. Certifications such as GCFA, GCIH or OSCP are preferred.

Who It Suits

Ideal for an experienced DFIR practitioner ready to step into a senior leadership role, combining hands-on forensic expertise with team mentorship, client-facing advisory work, and coordination with legal and insurance stakeholders during crises.