DFIR Expert (Lead)

The Role

This position leads end-to-end forensic investigations and incident response engagements, serving as the highest escalation point during confirmed breaches. Day to day involves hands-on analysis across file systems, memory, and networks, managing client communication, developing automation tools, and producing detailed incident reports with root cause analysis.

Skills & Experience

Candidates need three or more years in DFIR, threat hunting, SOC, or information security, with deep knowledge of Windows and Linux internals, network communications, and malware analysis — both static and dynamic. Familiarity with EDR platforms, SIEM solutions, and firewall datasets is essential, alongside strong forensic methodology and intrusion analysis skills.

Who It Suits

This role suits a technically strong, self-directed professional who is comfortable owning high-stakes investigations and leading others under pressure. Someone who combines sharp analytical thinking with clear communication will thrive, particularly if they enjoy shaping service delivery and contributing to business growth alongside purely technical work.