Cyber Consultant, DFIR
LevelBlue
Washington, DC
The Role
This consultant leads client-facing cybersecurity incident response engagements, performing forensic investigations across servers, workstations, networks and SaaS platforms. Responsibilities include evidence collection, root cause analysis, containment coordination, and producing detailed, narrative-driven incident reports for varied audiences.
Skills & Experience
Candidates need proven DFIR experience, proficiency with forensic tools such as X-Ways, and familiarity with incident response frameworks like NIST or SANS. Strong analytical ability, networking and OS knowledge, scripting familiarity, and relevant DFIR certifications are preferred.
Who It Suits
Suited to an experienced forensic investigator comfortable managing client relationships, working independently under deadlines, and occasionally traveling or being on-call to support active incident investigations.
Typical advertised salary for Incident Response roles in United States: $123,000–$179,000 (median $149,000 — from 159 recent listings analysed by Forensic Focus).
Compare Incident Response salaries in United States →
Certifications mentioned: SANS — find training for these on the DFIR Training Finder.