Senior Incident Response DFIR Consultant – Engagement Lead

Zurich Insurance

. Lead incident response engagements for external clients .

Posted 9/15/2026full-timeRemote • United StatesSenior💰 $100,200 - $164,100 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates advanced proficiency in Digital Forensics and Incident Response, with expertise in Threat Intelligence, Malware Analysis, and Client Communication. Capable of leading incident response engagements, mentoring junior staff, and delivering executive-level reports while ensuring quality standards and timelines are met.

Highest-signal resume keywords

Digital Forensics & Incident ResponseThreat Intelligence & Malware AnalysisClient Communication & Stakeholder ManagementWindows/Linux Operating System ForensicsForensic Tools (EnCase, FTK, X-Ways, Volatility, Binalyze)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Digital ForensicsIncident ResponseMalware AnalysisThreat IntelligenceNetwork ForensicsLog AnalysisCloud Security (Azure/AWS/M365)Ransomware InvestigationsBusiness Email Compromise (BEC)Report Writing

Soft Skills

Client CommunicationStakeholder ManagementMentoringProject Management

Tools & Technologies

EnCaseFTKX-WaysVolatilityBinalyze

Certifications & Qualifications

Cyber Security Certification

Industry Keywords

Incident Response EngagementsDigital Forensics InvestigationsThreat Actor AttributionCyber SecurityExecutive Briefings

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityLinux

About the role

Key responsibilities & impact

Lead incident response engagements for external clients
Conduct digital forensics investigations, malware analysis, and threat actor attribution
Provide 24/7 on-call incident response, remotely connecting to contain active threats, preserve evidence, and minimize disruption
Examine compromised systems, networks, and cloud environments using industry-standard tools and methodologies
Deliver executive-level briefings and written reports with business impact assessments and recommendations
Coordinate incident response with IT teams, legal counsel, insurance carriers, law enforcement, and executive leadership
Provide guidance on ransomware negotiations, business email compromise, insider threat, and advanced persistent threat incidents
Mentor junior consultants and analysts and provide quality assurance
Maintain case documentation, time tracking, and engagement status reporting
Partner with insurance brokers, managed service providers, and law firms on cyber insurance claims and breach response
Research emerging threats, attack techniques, and forensic methodologies
Contribute to thought leadership through blog posts, conference presentations, and client education materials
Develop scopes of work and cost estimates
Identify opportunities for expanded client engagements
Support business development through client presentations, capability demonstrations, and proposal development
Ensure deliverables meet quality standards and agreed timelines and budgets
Travel as required

Requirements

What you’ll need

Bachelor’s degree and 5 or more years of experience in the Cyber Security domain; OR Zurich Cybersecurity Technician Apprentice, including Cyber Security Certification and 6 or more years of experience in the Cyber Security domain; OR High School Diploma or Equivalent and 7 or more years of experience in the Cyber Security domain
Advanced proficiency in Digital Forensics & Incident Response
Intermediate proficiency in Threat Intelligence & Malware Analysis
Advanced proficiency in Client Communication & Stakeholder Management
Advanced proficiency in Windows/Linux Operating System Forensics
Intermediate proficiency in Network Forensics & Log Analysis
Intermediate proficiency in Cloud Security (Azure/AWS/M365)
Advanced proficiency in forensic tools including EnCase, FTK, X-Ways, Volatility, and Binalyze
Advanced proficiency in Ransomware & Business Email Compromise (BEC) Investigations
Advanced proficiency in Report Writing & Executive Communication
Intermediate proficiency in Project Management
Threat Actor Communications Experience
Ability to provide 24/7 on-call incident response services
Willingness to work remotely within the U.S. and travel up to 5% as required
Employment sponsorship is not offered

Benefits

Comp & perks

Short-term incentive bonus eligibility set at 15%
Competitive pay
Comprehensive benefits for employees and their families
Growth, inclusion, and a supportive environment
Potential merit increases