Sr. Principal Consultant, DFIR

About the Role

We are seeking a highly skilled and motivated Digital Forensics and Incident Response (DFIR) Specialist to join our Global LevelBlue DFIR team. The ideal candidate will be responsible for investigating and responding to cybersecurity incidents, conducting digital forensic and incident response investigations, and working independently against engagement milestones from forensics to log analysis to report writing.

Responsibilities

• Lead and coordinate responses to cybersecurity incidents, including identification, containment, eradication, and recovery.
• Analyse and investigate security breaches to determine the root cause and impact.
• Conduct digital forensic science-based incident response investigations on a variety of digital devices, including servers, end-user workstations, network systems, and SaaS platforms.
• Collect, preserve, and analyse digital evidence in accordance with legal and regulatory requirements.
• Prepare detailed incident reports, articulating a clear story for non-technical audiences.
• Maintain accurate and thorough documentation of all incident response activities and forensic investigations.
• Collaborate with internal teams (DFIR, Advisory, Testing, Threat Intelligence, MDR/MSS) and external clients (IT, legal, compliance, vendors) to support expert delivery during engagements.
• Communicate effectively with stakeholders to provide updates and ensure alignment with incident response processes.

Qualifications

• Proven experience in DFIR.
• Strong knowledge of digital forensics tools and techniques, including X-Ways or similar.
• Experience with incident response frameworks and methodologies (NIST, SANS, or similar).
• Excellent analytical and problem-solving skills.
• Strong understanding of network protocols, operating systems, and security technologies.
• Excellent written and verbal communication skills.
• Ability to work independently and manage multiple projects simultaneously.
• Flexibility to support occasional travel and work outside standard business hours, including participation in an on-call schedule.

Preferred Qualifications

• Bachelor's or Master’s degree in Digital Forensics, Computer Science, or a closely related field.
• DFIR industry-accepted certifications.
• Knowledge of scripting languages (Python, PowerShell) for automation and analysis.
• Knowledge of database formats for investigative purposes.
• Knowledge of cloud platforms (Azure, AWS, Oracle, GCP) for modern incident response engagements.

Why Join LevelBlue?

At LevelBlue, you’re part of a team making a real difference in cybersecurity. We foster a culture of innovation and creativity where your contributions are valued, and you’ll have the support and resources to grow and thrive.

Benefits

• Comprehensive medical, dental, and vision insurance.
• 401(k) with employer matching.
• Generous paid time off and holidays.
• Flexible spending accounts and health savings accounts.
• Employee assistance programs.
• Training and development opportunities.
• Adoption assistance program.

This role is open to candidates legally authorized to work in the United States. LevelBlue supports flexible work arrangements and brings people together in person for key moments based on role, team, and business needs.