Senior Incident Response Consultant

About The Role

At Pondurance, we help organizations detect, respond to, and recover from cyber threats with confidence. Our Digital Forensics & Incident Response (DFIR) team partners with clients during some of their most critical moments, guiding them through investigation, containment, remediation, and recovery. We are seeking a senior-level incident response professional with a strong systems or network administration background who can support both forensics and remediation efforts.

Responsibilities

• Conduct forensic host, network, and application technical investigations
• Triage active high-stakes security events, including reviewing and applying security controls to detect, respond, prevent, and remediate threats
• Recognize and codify attacker tools, tactics, and procedures in indicators of compromise (IOCs) that can be applied to current and future investigations
• Develop custom scripts, tools, or methodologies to enhance our IR processes
• Prepare comprehensive and accurate reports of forensic findings and IR activities for both technical and executive audiences
• Communicate investigative findings and strategy to various client stakeholders
• Provide immediate, actionable guidance to contain and mitigate ongoing attacks
• Aid in scoping new engagements and guide clients through the full incident response lifecycle
• Work directly with client IT teams to support rebuild, reconfiguration, and remediation efforts
• Remotely guide clients through EDR deployments, system configuration changes, and technical recovery steps
• Support the full incident response lifecycle from discovery through reporting
• Participate in an on-call rotation to provide after-hours and weekend incident response support as needed

Technologies

• Windows operating systems and networking protocols
• Active Directory administration and recovery
• Virtualization technologies such as HyperV and VMware ESXi
• Disk and memory forensics
• Network traffic analysis
• Experience with EDR platforms such as CrowdStrike, SentinelOne, or Huntress
• Experience with forensic toolsets such as FTK, AXIOM, KAPE, or similar
• Scripting experience using PowerShell, Python, or similar

Knowledge And Skills

• Significant experience in a forensic and incident response role
• Strong background in systems or network administration
• Hands-on experience with Active Directory administration and troubleshooting
• Experience responding to ransomware or complex security incidents
• Ability to work directly with clients in high-pressure situations
• Demonstrated ability to analyze incidents and recommend effective remediation and countermeasures
• Experience in a technical consulting or client-facing role

Preferred Certifications

• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Reverse Engineering Malware (GREM)
• MCFE
• EnCE