DFIR Expert

The Role

This position involves leading technical response to major security incidents, from initial escalation through containment, eradication and recovery. The expert conducts end-to-end forensic investigations across cloud, platform and endpoint systems, handles evidence to legal standards, and produces detailed reports and root cause analyses.

Skills & Experience

Around five years of DFIR experience is required, including deep knowledge of Windows and Linux internals, disk and memory forensics, cloud and container forensics, and attacker TTPs. Familiarity with tools like Velociraptor, Volatility, X-Ways or EnCase, scripting in Python/PowerShell/SQL, and certifications such as GCFE, GCFA or GREM are advantageous.

Who It Suits

Ideal for an experienced forensic investigator comfortable operating under pressure during high-impact incidents, who can mentor SOC analysts, communicate findings to technical and executive stakeholders, and contribute to building mature DFIR capabilities.