Senior Digital Forensics and Incident Response Consultant

CYPFER

. Lead small workstreams within active incident response and recovery engagements under a Manager or Senior Manager .

Posted 10/14/2026full-timePhoenix • Arizona • United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in incident response and digital forensics, with a strong focus on forensic acquisition, IOC triage, and recovery analysis. Proficient in coordinating workstreams, managing client expectations, and delivering high-quality, client-ready artifacts while adhering to compliance and quality standards.

Highest-signal resume keywords

Incident ResponseDigital ForensicsGCFA CertificationEDR PlatformsPython Scripting

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Forensic AcquisitionIOC TriageEvidence PreservationArtifact TriageThreat ResearchEvent CorrelationTimeline ConstructionEndpoint ForensicsMalware AnalysisNetwork Forensics

Soft Skills

Customer ServiceRelationship ManagementCommunicationConfidentialityConsulting

Tools & Technologies

CrowdStrike FalconSIEMSOARIR Orchestration Platforms

Certifications & Qualifications

GCFAGCFRGCIHCCFRCCHFAWS Certified

Industry Keywords

CybersecurityIncident Response EngagementsCompliance RequirementsRisk TrackingProfessional Services

Tech Stack

Tools & technologies

AWSCyber SecurityPython

About the role

Key responsibilities & impact

Lead small workstreams within active incident response and recovery engagements under a Manager or Senior Manager
Coordinate Consultants and task execution across the team while ensuring deliverable quality and alignment with client objectives
Own workstream planning, stand-ups, and risk tracking across active engagements
Validate technical outputs, present interim findings to client stakeholders, and manage expectations
Deliver forensic acquisition, IOC triage, and recovery work packages
Maintain accurate case notes and produce client-ready artefacts while adhering to SOPs and QA standards
Escalate risks early and follow chain-of-custody and compliance requirements
Analyze triage collections and artefacts for indicators of compromise and malicious activity
Review host-system and appliance logs for suspicious activity
Collect forensic disk and memory images from physical and virtual endpoints and servers
Drive event correlation and timeline construction across engagements
Conduct threat research based on investigation IOCs and direct junior team members in targeted research tasks
Participate in a rotating on-call schedule and support deployments outside normal business hours

Requirements

What you’ll need

3–5+ years of experience in incident response, digital forensics, or a related cybersecurity role
Advanced capability in DFIR and post-breach recovery analysis
GCFA or GCFR certification strongly preferred
Ability to coordinate plans, tasks, and risks across an engagement workstream with multiple contributors
Experience presenting interim findings to client stakeholders and creating client-ready deliverables
Basic scripting proficiency in Python and/or PowerShell
Working knowledge of endpoint forensics, including evidence acquisition, preservation, and artefact triage across physical and virtual systems
Hands-on experience operating EDR platforms such as CrowdStrike Falcon for threat hunting, host isolation, and telemetry collection
Familiarity with SIEM, SOAR, or IR orchestration platforms
Ability to perform estimation and short-cycle planning within an engagement workstream
Ability to work weekends and outside normal business hours as needed
Ability to travel on short notice to client sites up to 50%; flexibility to travel within 24–48 hours' notice for deployments typically lasting 1–2 weeks
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent hands-on experience
Industry certifications such as GCFA, GCFR, GCIH, CCFR, CCHF, AWS Certified, or similar are a strong asset
Exposure to threat hunting, network forensics, or malware analysis methodologies
Experience in a professional services or consulting environment
Strong customer service, consulting, relationship management, communication, and confidentiality skills

Benefits

Comp & perks

Remote work arrangement
Rotating on-call schedule participation
Exposure to insurance, legal, and enterprise client engagements
Opportunities to lead workstreams and direct junior team members
Hands-on work with DFIR and post-breach recovery
Professional experience with client-facing consulting and emerging service delivery leadership