Lead Consultant – Incident Response

About the role

The Lead Consultant – Incident Response will head technical and coordination activities for active cyber‑incident engagements within a high‑impact DFIR team. You will drive blue‑team operations, perform forensic investigations and guide stakeholders through complex security incidents.

Key responsibilities

• Serve as technical and coordination lead on active incident response engagements, communicating progress to clients.
• Execute threat‑hunting, host and network forensics across Windows, macOS and Linux platforms.
• Produce detailed reports, technical briefs and quality‑assure work of junior team members.
• Maintain and develop the DFIR lab, lead research and internal brown‑bag sessions.

Required profile

• Excellent English communication and stakeholder‑management skills.
• GIAC certification in at least one discipline (e.g., GNFA, GCIH, GCFA) or equivalent.
• Prior experience in digital forensics (mandatory) and malware analysis (desirable).
• Attention to detail, strong reporting accuracy and ability to work independently after an initial onboarding period.

Required skills

• Incident response and digital forensics.
• Host, network, mobile and cloud forensics.
• Malware analysis (static and dynamic).
• Threat hunting and OT/ICS incident response.
• AI security processes.
• ATT&CK framework knowledge.
• Network analysis tools (Bro/Zeek, Rita, Suricata) and system/network log analysis.
• Forensic analysis on Windows, Linux and macOS environments.