Digital Forensics & Incident Response

The Role

Practitioners are matched to client engagements based on availability and expertise, conducting end-to-end digital forensic investigations across host, network, cloud, and mobile environments. Responsibilities span initial triage through containment and recovery, evidence collection, chain-of-custody handling, and production of defensible incident reports for technical and executive audiences.

Skills & Experience

Substantial hands-on DFIR experience is essential, with strong grounding in forensic methodology, IR frameworks, and evidence handling. Relevant certifications such as GCFA, GCIH, GNFA, GREM, or EnCE are advantageous but not mandatory. Clear communication under time pressure and the ability to direct response teams are equally important.

Who It Suits

This role suits seasoned DFIR professionals seeking flexible, engagement-based work — whether part-time or full-time — without committing to a single employer. It is well suited to experienced practitioners comfortable operating as an individual contributor or stepping into an engagement lead role as client needs demand.