INCIDENT RESPONSE LEAD, DFIR (USA)

Responsibilities

• Lead investigations including business email compromise, ransomware, network intrusions, and insider threats. Your initial focus will be on cloud-based email attacks across Google and Microsoft environments.
• Build defensible timelines and substantiate findings across log sources.
• Take challenging forensic problems, including uncovering novel attack paths.
• Codify best practices, contributing to case handbooks.
• Partner with the engineering team to develop AI DFIR tools.

Requirements

• Have significant experience in major incident investigations and forensic analysis efforts.
• Have investigated cloud-based attacks in Microsoft and/or Google Workspace.
• Be skilled in developing playbooks and analysis plans for complex forensic investigations.
• Communicate technical findings clearly with key stakeholders and team members.
• Be excited about uncovering novel threat actor TTPs.