Senior Consultant - Incident Response (CPX)

About the Role:
As a Senior Incident Responder in the Incident Response & Forensics Team, you will work within a high-impact and operationally critical cyber defense environment. Your role requires technical expertise in digital forensics and cyber incident response, complemented by your integrity and passion for cybersecurity and technology. You will collaborate with a team of skilled blue teamers, while also being able to work independently in different engagements and scenarios. You're encouraged to embrace new challenges in a dynamic, fast-paced environment, while maintaining a humble and positive attitude as a team player.

Responsibilities:

• Serve as technical lead on active incident response engagements, leveraging your 3-5 years of relevant experience.
• Communicate investigation progress effectively to clients, utilizing your English communication and stakeholder management skills.
• Execute threat hunting activities in support of incident response engagements and Security Operation Center (SOC) activities.
• Perform host and/or network-based forensics across Windows, Mac, and Linux platforms.
• Conduct digital forensic investigations that support cyber incident response engagements.
• Contribute to process documentation and continuous service improvement activities.
• Produce detailed reports and technical briefs, effectively communicating tasks, methodologies, and guidance to customers.
• Explain technical findings in a manner understandable by both technical and non-technical stakeholders.
• Demonstrate industry thought leadership through internal knowledge-sharing sessions.
• Conduct research activities to enhance service improvement tasks and better understand the threat landscape.
• Help maintain the client-fostered Digital Forensics and Incident Response (DFIR) Forensics Lab.
• Act as the team’s subject matter expert in at least one vertical: host forensics, network forensics, mobile forensics, malware analysis, OT/ICS incident response, cloud forensics, or threat hunting.
• Independently achieve tasks within the team after an initial 3-month period. Note that a flexible schedule is essential to accommodate changing situations and opportunities.

Technical Skills:

• Strong understanding of blue team operations, incident response management, and digital forensics techniques.
• Sound understanding of network protocols (TCP/IP, etc.).
• Proficient with Microsoft Windows, Linux, and OSX.
• Strong forensic skills across multiple operating systems.
• Familiarity with network analysis tools such as Bro/Zeek, Rita, or Suricata.
• Ability to analyze system and network device logs.
• Knowledge of modern mobile devices and their operating systems.
• Understanding of static and dynamic malware analysis.
• Solid comprehension of enterprise systems, technologies, and infrastructure.
• Knowledge of targeted attacks and the ability to create tailored remediation plans for compromised organizations.
• Updated awareness of current threats, vulnerabilities, and attack trends.
• Strong grasp of the ATT&CK framework.
• Familiarity with AI security processes and the use of AI in Incident Response investigations.
• Excellent organizational skills with the ability to prioritize and work independently.
• Capacity for rapid learning and day-to-day application of acquired knowledge.

Qualifications:

• Attention to detail and reporting accuracy, coupled with strong stakeholder management and communication skills.
• Proven proficiency in spoken and written English.
• GIAC certifications in a minimum of one discipline such as GNFA, GCIH, GCIA, GCFE, GCFA, GDAT, etc., or equivalent (e.g., eLearnSecurity).
• Previous experience performing digital forensics is a must.
• A Bachelor's degree in Computer Science or Engineering is desirable but not mandatory.