Senior Incident Response Consultant

About the role

The Incident Response team is focused on supporting the IR lifecycle and providing indicators to the SOC that will assist in enhanced detection capabilities of network, log, and host data. You must have the technical chops to analyze intrusions, detect incidents, and assist in responding to our clients. You must be capable of working with our clients in a high‑stress IR situation to effectively navigate through the IR lifecycle. You will be responsible for not only leading the technical analysis of an Incident Response investigation, but also for communicating effectively and providing off‑hours support as needed. This is a hybrid role; candidates must be located in the McLean, VA area and are expected to work in the McLean office approximately 20 % of the time for device collection and other business needs.

Responsibilities

• Conduct forensic host, network, and application technical investigations.
• Triage active high‑stakes security events, including reviewing and applying security controls to detect, respond, prevent, and remediate threats.
• Recognize and codify attacker tools, tactics, and procedures in indicators of compromise (IOCs) that can be applied to current and future investigations.
• Develop custom scripts, tools, or methodologies to enhance our incident response processes for a wide range of systems and technologies.
• Create comprehensive and accurate reports of forensic findings and IR activities for both technical and executive audiences.
• Effectively communicate investigative findings and strategy to client stakeholders, including technical staff, executive leadership, third‑party stakeholders, underwriters, and legal counsel.
• Provide clients with immediate actionable 0‑day cybersecurity advice to stop and mitigate the damage of ongoing attacks.
• Assist with the scoping of new engagements using a whole‑lifecycle approach, guiding the client from initial discovery through mitigation and remediation.

Technologies

• Strong hands‑on working knowledge of Windows OS and networking protocols.
• Windows disk and memory forensics.
• Unix OS and networking protocols.
• Network traffic analysis.
• Scripting and/or programming.
• Experience with commercial EDR (SentinelOne, BlackBerry PROTECT, Carbon Black, CrowdStrike).
• Forensic tool suites (FTK, AXIOM, EnCase).
• Reverse engineering and malware analysis.

Knowledge and Skills

• 4+ years of experience in a forensic and incident response role.
• One or more of the following technical certifications preferred: GIAC Certified Incident Handler (GCIH), GIAC Certified Forensic Analyst (GCFA), GIAC Reverse Engineering Malware (GREM), MCFE, EnCE, or equivalent.
• Demonstrated experience using analytical skills in a cybersecurity environment to triage and detect events, including ransomware forensic investigations.
• Demonstrated ability to make decisions on remediation and countermeasures for challenging information security threats.
• Experience in a technical role for a consulting company.
• Additional relevant skill combinations are welcome.

Compensation

The anticipated base salary range for this position is $110,000 – $136,000 annually. Actual compensation will be determined in good faith based on factors such as relevant experience, technical expertise, certifications, geographic location, and internal equity. This position may also be eligible for bonus or other incentive compensation, as well as the benefits described below.

What We Offer

• Opportunity to apply your expertise, take on new challenges, and help customers address their biggest security objectives.
• An inclusive culture of teamwork that embraces the diversity of our people and communities.
• Corporate benefits for full‑time employees, including medical, dental, vision, disability, FSA, HSA, life, and AD&D insurance, and a 401(k) plan.
• Generous time‑off policies: PTO, sick leave, holidays, and parental leave.
• Background and drug screenings as part of the hiring process.

About Pondurance

At Pondurance, we embrace, educate, and protect people by helping make our world a better and safer place. We invite good people into our company who are driven to become great. Every person is encouraged to focus and grow in their individual areas of interest, passion, and career path. Accessible leaders act as mentors, believing “None of us are as smart as all of us.” We celebrate individuality, encourage speaking up, and strive to influence real change in the security and cyber‑risk landscape.