Sr. Principal Consultant, DFIR

The Role

This senior consulting position sits within a global DFIR team and focuses on leading end-to-end incident response engagements — from initial identification and containment through to forensic analysis and recovery. Day-to-day work spans host and network forensics, cloud platform investigations, log analysis, and the preparation of clear, narrative-driven incident reports for both technical and non-technical audiences.

Skills & Experience

Candidates should bring proven DFIR experience and strong familiarity with forensic tooling such as X-Ways, alongside knowledge of IR frameworks including NIST and SANS. Cloud platform experience across Azure, AWS or GCP is valued, as are scripting skills in Python or PowerShell. Industry-recognised DFIR certifications and a relevant degree are preferred.

Who It Suits

This role suits an experienced DFIR professional comfortable working independently on complex engagements under pressure, managing multiple concurrent investigations while collaborating with client legal, compliance and IT teams. Those who combine deep technical forensics skills with the ability to communicate findings clearly to senior stakeholders will thrive here.