Principal DFIR Consultant – Remote (Anywhere in the U.S.)

The Role

Operating as the practice’s foremost technical authority, this role leads the most complex and high-severity DFIR engagements — including ransomware, APT and insider-threat investigations. Day-to-day responsibilities span advanced host and cloud forensics, network analysis, malware triage, threat actor attribution, QA oversight of team deliverables, and direct engagement with client security and legal teams.

Skills & Experience

Candidates require deep expertise across the full forensic stack: host and memory forensics, network traffic analysis, cloud forensic techniques, and malware reverse engineering. Experience leading high-stakes IR engagements, communicating findings to executive and legal audiences, and mentoring senior practitioners is essential. Familiarity with cyber insurance and breach counsel workflows is advantageous.

Who It Suits

This position suits a highly experienced DFIR professional ready to operate as a principal-level individual contributor without moving into pure management. It is ideal for someone who thrives on technically demanding investigations, enjoys shaping practice methodology, and wants to influence the broader DFIR community through research, mentorship, and business development.