DFIR Consultant

Vector3, Inc., is an incident response firm supporting TMHCC Cyber and Professional Lines Group (CPLG). Vector3 specializes in responding to Business Email Compromise (BEC) and Ransomware incidents, helping insured organizations investigate, contain, and recover from cyber events.

Tokio Marine HCC (TMHCC) brings 50 years of service to the specialty insurance industry, offering over 100 products to commercial customers in 180 countries. With a workforce of 4,300 worldwide, TMHCC combines organic growth and successful acquisitions to achieve over $7.5 Billion in Gross Written Premium (GWP). Our culture emphasizes integrity, empowerment, customer service, innovation, communication, and collaboration.

About the role

Join the Digital Forensics and Incident Response (DFIR) team at Vector3 as a key contributor. You will apply investigative experience to support client incidents from initial triage through evidence preservation, analysis, and reporting. Work closely with your team on complex investigations to deliver timely, accurate, and defensible findings that aid recovery and informed decision-making.

Responsibilities

• Perform triage, acquisition, preservation, and analysis of endpoint, server, cloud, and log evidence to determine scope, impact, and root cause.
• Develop accurate timelines, identify affected assets and accounts, and document investigative findings clearly and defensibly.
• Support analysis of malware, suspicious scripts, persistence mechanisms, credential theft, lateral movement, and data theft activity using repeatable methods and validated workflows to ensure evidence integrity and investigation quality.
• Communicate professionally with internal stakeholders, clients, insurers, legal counsel, and other approved parties during active matters.
• Prepare concise updates, investigation notes, and report content that translate technical detail into actionable business and response guidance.
• Support status calls, evidence requests, and coordination of next steps across involved teams.
• Contribute to playbooks, templates, evidence handling procedures, and knowledge articles to improve team efficiency and consistency.
• Identify repeatable investigative tasks that can be standardized, automated, or improved for scale.
• Support after-action reviews and lessons learned to strengthen the DFIR practice and client outcomes.
• Apply strong technical analysis skills to digital forensic evidence, incident data, and client environments.
• Write or contribute significantly to investigative reports and documentation while working accurately under time pressure.
• Develop innovative ways to improve financials and increase operational efficiency.
• Comply with all corporate policies and procedures, and help implement cost-effective controls for the designated function.

Requirements

• Minimum 4-year bachelor’s degree in cyber security, Computer Science, Information Technology, or a related field.
• 2+ years of professional experience in digital forensics, incident response, security operations, or related investigative work.
• Experience performing endpoint, server, and cloud log analysis in support of cyber incidents.
• Familiarity with common DFIR tools, evidence handling, and report writing.
• Ability to manage multiple active matters while maintaining quality and deadlines.
• Excellent communication skills to clearly convey complex technical concepts to stakeholders.

Qualifications

Preferred advanced degrees or certifications such as CISSP, CISM, GCFE, GCFA, GREM, GBFA, GCIH, CFCE, or CCE.

Benefits

• Competitive salary and employee benefit package
• Strong learning culture
• Growth perspectives
• 6% 401K match
• 20 days of PTO and 2 floating days
• Paid parental leave

Pay

The pay range for this position is $87,400–$131,000, including geographic adjustments where applicable. The final offer will be based on the candidate’s geographic location, qualifications, work experience, education, and skill level.