Senior Consultant, DFIR, Reactive Services

Palo Alto Networks

. Execute digital forensics and incident response investigations involving ransomware, unauthorized access, and other cybersecurity incidents .

Posted 10/28/2026full-timeRemote • California • United StatesSenior💰 $132,800 - $182,600 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in digital forensics and incident response, with a strong focus on evidence acquisition, analysis, and client communication. Proficient in utilizing forensic tools and methodologies to investigate cybersecurity incidents and provide actionable recommendations.

Highest-signal resume keywords

Digital ForensicsIncident ResponseForensic Tools ProficiencyMalware TriageGCFA Certification

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Evidence AcquisitionLog AnalysisWindows InvestigationLinux FamiliarityMacOS FamiliarityCloud EnvironmentsScriptingMITRE ATT&CK KnowledgeTechnical Report PreparationChain-of-Custody Procedures

Soft Skills

Strong Technical JudgmentClient CommunicationCollaboration

Certifications & Qualifications

GCFAGCFEGCIH

Industry Keywords

CybersecurityRansomwareUnauthorized AccessIncident ContainmentRemediationRecoveryEmerging ThreatsAttacker TechniquesForensic MethodologiesConsulting Services

Tech Stack

Tools & technologies

CloudCyber SecurityLinuxMacOS

About the role

Key responsibilities & impact

Execute digital forensics and incident response investigations involving ransomware, unauthorized access, and other cybersecurity incidents
Own assigned investigative workstreams and escalate findings and blockers to the engagement lead
Analyze endpoint, host, network, identity, and cloud evidence to establish incident timelines, attacker behavior, and scope of compromise
Perform forensic acquisition and analysis of systems, memory, logs, and endpoint telemetry
Support incident containment, remediation, and recovery through evidence-based recommendations
Document investigative activities and prepare technical reports and client updates
Follow evidence handling and chain-of-custody procedures
Collaborate with engagement teams to deliver timely, high-quality client outcomes
Contribute to investigation playbooks, tools, and knowledge sharing
Maintain knowledge of emerging threats, attacker techniques, and forensic methodologies
Communicate findings directly to clients while working alongside Principal Consultants and Consulting Directors

Requirements

What you’ll need

Hands-on enterprise DFIR experience
Proficiency with forensic tools, evidence acquisition, and log analysis
Experience investigating Windows
Familiarity with Linux, macOS, or cloud environments
Strong technical judgment and client communication
Relevant degree or equivalent practical experience
Consulting or incident response services background preferred
Malware triage, scripting, and MITRE ATT&CK knowledge preferred
GCFA, GCFE, GCIH, or similar certifications preferred
Willingness to travel up to 20% preferred
Must not require immigration sponsorship; the employer will not sponsor work visas for this position

Benefits

Comp & perks

Restricted stock units
Bonus
Employee benefits are referenced but not itemized
Reasonable accommodations for qualified individuals with a disability or special need