The Work:

Investigations & Forensic Analysis

• Conduct complex forensic investigations including advanced memory forensics, malware triage, encrypted artifact recovery, and anti-forensics detection
• Perform host and network digital forensics, log analysis, and threat hunting in support of incident response engagements
• Leverage EDR solutions, cloud platforms (AWS, Azure, GCP), and threat intelligence to identify and document attacker TTPs
• Participate in incident response across cloud, OT, and traditional enterprise environments
• Develop indicators of compromise and contribute to comprehensive, defensible attack timelines

Tool & AI Development

• Design and build proprietary investigation tools, automation scripts, and data products that accelerate forensic workflows and improve team consistency
• Translate repeatable investigation processes into functional prototypes using AI-assisted development, low-code platforms, and data visualization tools (Power BI, Azure Data Services, Python, or similar)
• Apply generative AI and AI coding assistants as core development accelerators - not occasionally, but fluently - to reduce manual effort across triage, analysis, and reporting
• Govern the tools you build: documentation, version control, onboarding guides, and iteration based on real-world engagement feedback
• Collaborate with senior practitioners to identify where new tooling improves speed, quality, or scalability across service offerings

Client Engagement

• Interface with client stakeholders and legal counsel throughout the engagement lifecycle, both technically and strategically
• Author comprehensive, defensible written reports on investigative findings
• Present technical findings and tool outputs on client calls
• Support leadership in scoping engagements with methodical, innovative approaches

Here’s What You Need:

• Bachelor’s Degree or equivalent work experience
• Minimum of 3 years’ experience in:
• DFIR with demonstrated expertise in complex investigations
• Cybersecurity consulting and data-oriented development or analysis
• Building tools that others use in professional practice
• Minimum of 3 years demonstrated experience in:
• At least one data or development layer: Python, PowerShell, Power BI, Power Apps/Automate, SQL, or comparable stack
• Common DFIR toolsets (Volatility, X-Ways, FTK, EnCase, Autopsy, etc.)
• Microsoft Windows, GNU/Linux, and MacOS operating systems
• Memory forensics
• Enterprise environments, Active Directory, and common attack patterns
• Threat hunting on both endpoints and networks
• Industry recognized incident response lifecycles and frameworks (e.g., SANS, NIST, MITRE, etc.)
• Producing accurate, defensible, well-documented analysis
• Minimum of 1 year demonstrated experience in:
• Using AI coding assistants and generative tools as a fluent part of your everyday development workflow
• Azure and cloud-native architectures; comfort using AI as a development accelerator

Bonus Points If:

• Experience with cloud forensics across AWS, Azure, and GCP; OT/ICS environments a plus
• Malware analysis capabilities: unpacking, deobfuscation, behavior analysis, reverse engineering
• Experience with AI governance, responsible use frameworks, or tool validation in a security or consulting context