DFIR Case Manager (Remote)

Responsibilities

• Conduct scoping calls to gather all relevant information for generating an accurate statement of work.
• Direct client engagements and maintain regular communication with engagement stakeholders, including clients and attorneys.
• Case intake for the team and case management lifecycle (scoping calls, preparing SOWs, work products, final reports, and invoicing).
• Manage individuals who directly report to them.
• Communicate complex technical findings in layman's terms, both in person and on camera during virtual meetings.
• Provide quality control of work product and actively participate in Incident Response and digital forensics concerning ransomware, business email compromises, litigation support, and other cyber incidents.
• Manage multiple engagements simultaneously and effectively.
• Participate in Incident Response and digital forensics concerning ransomware, business email compromises, litigation support, and other cyber incidents.
• Resolve cybersecurity incidents by communicating and engaging with threat actors.
• Create, develop, and implement modern forensic techniques or solutions.
• Ongoing self-development and training in best practices for incident response and computer forensics to attain technical and leadership excellence.
• Produce high-quality technical reports and conduct a thorough review of the report, focusing on grammar, spelling, formatting, and professionalism.

Requirements

• A Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Information Security, or other related fields is preferred, but not required.
• 5 to 10 years of leadership experience with a proven track record in managing Incident Response efforts.
• Must be an effective problem solver, demonstrating the ability to tackle challenges independently and manage tasks with minimal supervision.
• Must possess exceptional communication skills and the ability to articulate complex technical findings in layman's terms.
• Must have in-depth knowledge of Incident Response, threat actor groups, and lead investigative efforts from start to finish.
• Professional certifications such as GCFE, GCFA, GCIH, GNFA, GASF, CISSP, and other relevant certifications are preferred.

Qualifications

• High availability and responsiveness to deadlines.
• Weekend and non-traditional work hours are necessary for the position.