DFIR Consultant

7AI

. Lead emergency incident response engagements end to end, from initial scoping call through final report .

Posted 11/5/2026full-timeBoston • Massachusetts • United StatesSeniorLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in digital forensics and incident response, with a strong focus on leading client engagements and managing complex investigations across various platforms. Proficient in evidence collection, analysis, and reporting, while maintaining compliance with legal and regulatory standards.

Highest-signal resume keywords

Digital Forensics ExpertiseIncident Response LeadershipHands-On Velociraptor ExperienceScripting in Python or PowerShellGIAC Certifications (GCFA, GCFE, GREM)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Digital ForensicsIncident ResponseEvidence CollectionMemory AnalysisLog CorrelationMalware AnalysisVQL ArtifactsKQL QueryingScriptingCloud Forensics

Soft Skills

Excellent Communication SkillsCalm Under PressureDecisive Leadership

Tools & Technologies

7AI PlatformVelociraptorSIEMEDRAWSAzureGCPMicrosoft 365Google Workspace

Certifications & Qualifications

GIAC GCFAGIAC GCFEGIAC GNFAGIAC GREMGIAC GCIHCISSP

Industry Keywords

Emergency Incident ResponseBreach CounselCyber InsuranceChain of CustodyManaged Detection and Response

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformLinuxMacOSPythonSQL

About the role

Key responsibilities & impact

Lead emergency incident response engagements end to end, from initial scoping call through final report
Run scoping calls with clients, breach counsel, and cyber insurance carriers
Define engagement scope, objectives, and deliverables
Plan investigations, coordinate evidence collection, track timelines and budgets, and update clients and counsel
Lead and personally perform enterprise investigations across host, network, cloud, SaaS, and application evidence
Investigate ransomware, business email compromise, data theft, and intrusion matters
Serve as escalation point for forensic collection, malware analysis, and root-cause determination
Mentor PLAID ELITE analysts through investigations
Collect and analyze evidence using the 7AI platform and Velociraptor
Write and maintain VQL artifacts
Validate and test AiDFIR output against source evidence for accuracy, completeness, and risk
Flag errors and uncertainty while applying expert human judgment to client conclusions
Build platform skills and develop tooling to improve investigative workflows
Own interim updates, findings briefings, and final reports for executives, attorneys, and engineers
Maintain defensible evidence handling, including chain of custody, and work within privilege as directed by counsel
Incorporate lessons learned into methodology, playbooks, and platform
Collaborate with Engineering and Product to shape the 7AI platform and AiDFIR roadmap
Participate in an on-call rotation for emergency response

Requirements

What you’ll need

8+ years of digital forensics and incident response experience, including leading client-facing engagements at a consultancy or IR firm
Track record of leading emergency IR engagements directed by breach counsel and cyber insurance carriers, from scoping through delivery of findings to counsel
Deep enterprise forensics expertise across Windows, macOS, Linux, network, AWS, Azure, GCP, Microsoft 365, Google Workspace, and application evidence
Experience with memory analysis and large-scale log correlation
Hands-on Velociraptor experience, including writing VQL artifacts
Scripting experience in Python, PowerShell, or similar
Working knowledge of malware analysis
Experience querying SIEM and EDR data with KQL, SPL, FQL, or SQL
Ability to evaluate automated or AI-generated analysis against raw evidence
Excellent written and verbal communication skills
Calm, decisive presence in crisis situations
Ability to support on-call emergency response
GIAC certifications (GCFA, GCFE, GNFA, GREM, GCIH) and/or CISSP are nice to have
Prior managed detection and response (MDR) experience is nice to have
Are you authorized to legally work in the US?
Currently located in the greater Boston area and able to come into the office 4 days per week, or open to relocating

Benefits

Comp & perks

AI-driven platform and tooling environment
Opportunity to shape the 7AI platform and AiDFIR roadmap
Professional development through writing Velociraptor artifacts, building platform skills, and developing investigative tooling
Collaboration with Engineering and Product
Participation in a PLAID ELITE DFIR team
Hybrid work arrangement with onsite work 4 days per week