Consultant

• Lead emergency incident response engagements end to end, from initial scoping call through final report
• Run scoping calls with clients, breach counsel, and cyber insurance carriers
• Define engagement scope, objectives, and deliverables
• Plan investigations, coordinate evidence collection, track timelines and budgets, and update clients and counsel
• Lead and personally perform enterprise investigations across host, network, cloud, SaaS, and application evidence
• Investigate ransomware, business email compromise, data theft, and intrusion matters
• Serve as escalation point for forensic collection, malware analysis, and root-cause determination
• Mentor PLAID ELITE analysts through investigations
• Collect and analyze evidence using the 7AI platform and Velociraptor
• Write and maintain VQL artifacts
• Validate and test AiDFIR output against source evidence for accuracy, completeness, and risk
• Flag errors and uncertainty while applying expert human judgment to client conclusions
• Build platform skills and develop tooling to improve investigative workflows
• Own interim updates, findings briefings, and final reports for executives, attorneys, and engineers
• Maintain defensible evidence handling, including chain of custody, and work within privilege as directed by counsel
• Incorporate lessons learned into methodology, playbooks, and platform
• Collaborate with Engineering and Product to shape the 7AI platform and AiDFIR roadmap
• Participate in an on-call rotation for emergency response

Explore DFIR Consultant at 7AI. Review requirements and application details.

Open roles

DFIR Consultant