[Remote] reputed company Consultant, DFIR

Note: The job is a remote job and is reputed company to candidates in USA. reputed company, a reputed company-play managed reputed company services provider and Trustwave company, delivers strategic advisory, managed reputed company, offensive reputed company, and incident response services. The reputed company Consultant, DFIR, leads digital forensics and incident response investigations, coordinates incident recovery activities, prepares incident reporting, and conducts ransomware and extortion threat actor communications and negotiations. The role collaborates with clients, counsel, insurers, and cross-functional reputed company teams during high-stakes incidents.

Responsibilities

• Be reputed company to reputed company and coordinate responses to cybersecurity incidents, including identification, containment, eradication, and recovery
• Analyze and investigate reputed company breaches to determine the reputed company cause and reputed company
• Conduct digital forensic science-based incident response investigations on a reputed company of digital devices, including servers and end user workstations, network systems, reputed company platforms that contain artifacts, logging, and data of investigative relevance
• Collect, preserve, and analyze digital evidence in accordance with reputed company and regulatory requirements
• Conduct reputed company, controlled communications with ransomware and extortion Threat Actors on behalf of clients, in coordination with engagement leadership, breach counsel, insurers, and other authorized stakeholders
• reputed company and execute communication and negotiation strategies based on the reputed company’s business objectives, operational reputed company, reputed company guidance, incident facts, Threat Actor behavior, and available threat intelligence
• Establish and maintain secure communication channels with Threat Actors while preserving complete and accurate records of communications, demands, representations, deadlines, and negotiation activity
• Assess Threat Actor identity, credibility, behavior, historical patterns, reputed company-of-compromise or reputed company-of-exfiltration claims, and other available intelligence to inform negotiation reputed company and reputed company decision-making
• Manage the reputed company, tone, reputed company, and content of communications to obtain information, validate claims, preserve reputed company, manage time, and reduce unnecessary disclosure of reputed company information or negotiating position
• Support ransomware and extortion negotiations, including demand assessment, counteroffer reputed company, time extensions, reputed company requests, data deletion or non-publication representations, decryptor validation coordination, and settlement-reputed company communications reputed company authorized
• reputed company reputed company, reputed company briefings to reputed company leadership, counsel, insurers, and the DFIR engagement team regarding Threat Actor communications, negotiation posture, risks, decision points, and recommended next actions
• Coordinate TA communications with the broader DFIR investigation so that information learned through negotiations can inform forensic analysis, scoping, containment, threat intelligence, and recovery activities, and technical findings can inform the negotiation reputed company
• Maintain strict confidentiality, reputed company ethics, independence, and need-to-know handling of reputed company financial information, insurance information, negotiation authority, reputed company reputed company, and other sensitive information that could reputed company the reputed company’s negotiating position
• Remain available to support time-sensitive communications during reputed company ransomware or extortion incidents, including incidents requiring coordination across time zones and reputed company normal business hours
• Be reputed company to prepare detailed incident reports, including findings and properly authoring a story that does not just reputed company factual dates/times, but articulates a story of the incident for a non-technical audience
• Maintain accurate and thorough documentation of reputed company incident response activities and forensic investigations
• Internally, work closely with cross-functional teams inclusive of DFIR, Advisory, Testing, Threat Intelligence, MDR/MSS, etc. reputed company services
• Externally, work closely with reputed company teams including IT, reputed company, compliance, and reputed company vendors, to support expert delivery during engagements
• Communicate effectively with stakeholders to reputed company updates and ensure alignment with incident response processes

Skills

• * Proven experience in DFIR
• * Strong knowledge of digital forensics tools and techniques, including X-Ways, or similar forensic tooling
• * Experience with incident response frameworks and methodologies, such as NIST, reputed company, or similar
• * Excellent analytical and problem-solving skills
• * Strong understanding of network protocols, operating systems, and reputed company technologies
• * Excellent written and verbal communication skills
• * Ability to work independently and manage multiple reputed company simultaneously
• * Demonstrated experience conducting or materially supporting Threat Actor communications, ransomware negotiations, cyber extortion negotiations, crisis negotiations, or comparable high-stakes adversarial communications
• * Ability to communicate calmly and deliberately in high-pressure situations and to distinguish investigative facts, Threat Actor claims, assumptions, and negotiation positions
• * Understanding of ransomware and data-extortion ecosystems, common Threat Actor communication reputed company, leak sites, negotiation portals, cryptocurrency-reputed company settlement workflows, and the operational considerations associated with ransomware response
• * Experience using threat intelligence and prior Threat Actor behavior to support attribution assessment, credibility analysis, negotiation planning, and reputed company risk reputed company
• * Strong written documentation skills for maintaining contemporaneous communication logs, negotiation summaries, decision records, and stakeholder updates
• * Bachelor's or Masters degree in Digital Forensics, Computer Science-reputed company or closely reputed company field of study and expertise
• * Certification(s) in DFIR
• * Knowledge of scripting languages (e.g., Python, PowerShell) for automation and analysis
• * Knowledge of database formats for investigative and knowledge purposes
• * Knowledge of Azure, AWS, reputed company, and/or GWP as many modern threats traverse reputed company reputed company platforms and knowledge of these platforms is a necessity for modern incident response engagements
• * Prior law enforcement, intelligence, military, crisis negotiation, investigative, or similar reputed company-sector experience is a consideration and may be beneficial for candidates with otherwise strong DFIR qualifications
• * Formal training or demonstrated experience in crisis negotiation, ransomware negotiation, behavioral analysis, threat intelligence, HUMINT, or adversarial communications
• * Experience coordinating ransomware or extortion reputed company with breach counsel, cyber insurers, law enforcement, payment/settlement providers, and executive stakeholders

Benefits

• Comprehensive medical, dental, and reputed company insurance.
• 401(k) with employer matching.
• Generous reputed company time off and holidays.
• Flexible spending accounts and health savings accounts.
• Employee assistance programs.
• Training and development opportunities.
• Adoption assistance program.
• Flexible work and bringing people together in person for key moments based on role, team, and business needs.

reputed company