Digital Forensics & Incident Response (DFIR) Consultant

Requirements

• Minimum 3 years of hands-on experience in digital forensics, incident response, cybersecurity investigations, or a related field.
• Practical experience conducting forensic investigations and handling digital evidence using tools such as Velociraptor, KAPE, Volatility, and Endpoint Detection and Response (EDR) platforms.
• Strong understanding of digital forensic methodologies, evidence acquisition, preservation, analysis, and chain-of-custody requirements.
• Experience analyzing endpoint, server, network, and cloud security logs to investigate security incidents and identify malicious activities.
• Hands-on knowledge of security investigations involving Microsoft 365 and Microsoft Entra ID.
• Working knowledge of Security Information and Event Management (SIEM) platforms and security monitoring technologies.
• Experience using Python or PowerShell for scripting, investigation support, and task automation.
• Understanding of incident response methodologies, including identification, containment, eradication, recovery, and post-incident analysis.
• Strong analytical, investigative, and problem-solving skills, with the ability to communicate technical findings effectively.
• Fluency in written and spoken English.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• Preferred Certifications: GCFA, GCFE, GCIH, or GNFA. GCFR (SANS FOR509) for cloud forensics is a plus.