Back to jobs

Principal Consultant, Digital Forensic and Incident Response (DFIR) (Remote)

Elkridge, Maryland, United States

About Surefire Cyber

Surefire Cyber is redefining the incident response model by delivering a swifter, stronger response to cyber incidents such as ransomware, email compromise, malware, data theft, and other threats. Our client-centric approach reduces stress and provides clients the confidence needed to prepare, respond, and recover from cyber incidents – and fortify their cyber resilience after an event.

Surefire Cyber’s approach and delivery are designed by industry veterans who have worked shoulder-to­shoulder with law firms, insurance carriers, brokers, law enforcement, and impacted organizations in responding to cyber incidents. We are marshaling this experience to address the industry’s persistent challenges of efficiency, predictability, and transparency

 

Job Title: Principal Consultant, Digital Forensics & Incident Response

Location: Remote (USA) 

Role: Full time 

Compensation: $100K-$160K annually

 

What Makes You Stand Out

You are a seasoned cybersecurity professional specializing in Digital Forensics and Incident Response (DFIR), with extensive experience, including client-facing roles, sophisticated forensic analysis, and a proven track record of independently managing investigations of varying sizes and complexities. Committed to continuous learning, you actively seek opportunities to expand your knowledge base, contributing to the team's collective expertise. 

In addition to technical proficiency, you excel at forensically guiding engagements and prioritizing competing priorities effectively. Demonstrated through a consistent delivery of high-quality results, your passion lies in mentoring colleagues and navigating the dynamic landscape of security incidents, showcasing a deep understanding of the evolving threat landscape. 

How You'll Make An Impact

As a Principal Consultant, you will represent Surefire Cyber as a skilled technical forensic and consulting expert for clients across diverse industries during active incident response engagements. Leveraging your extensive experience and technical skills, you will play a pivotal role in detecting and analyzing intrusions, offering clear guidance to clients navigating high-pressure response situations, and providing after-hours support as needed. 

Your Role In Action

  • Demonstrate genuine curiosity, a commitment to continuous learning, and contribute valuable insights to support the team's knowledge growth. 
  • Forensically lead incident response engagements, working with other team members to guide clients through the entire incident response lifecycle from detection to recovery.  
  • Conduct advanced forensic analysis to identify the scope and impact of security incidents meticulously and precisely, including malware analysis and reverse engineering when necessary. 
  • Independently manage investigations ranging in size and complexity such as Business Email Compromises and Ransomware engagements 
  • Provide career development for a Forensic team consisting of 3-4 Consultants/Senior Consultants, by investing in their professional development conducting regular one-on-one conversations and providing guidance and recommendations on training opportunities.  
  • Identify, articulate, and explain attack vectors, threat tactics, and attacker techniques to guide mitigation and prevention efforts.  
  • Convey complex forensic findings to technical and non-technical stakeholders clearly and understandably. 
  • Provide comprehensive supporting evidence for written reports detailing incident findings, and analysis. 
  • Review, provide well thought out input, and provide guidance to other team members on forensic reports.  
  • Collaborate with internal teams, external partners, and clients to refine and document incident response processes and best practices. 
  • Spearhead research and development activities to stay up to date with the latest forensic tools, techniques, and methodologies.  
  • Contribute to the development of internal processes and support broader organizational initiatives. 
  • Provide after-hours (on-call/weekend rotational) support as required to address critical incidents and maintain continuous coverage. 

Your Expertise

  • Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, related degree, industry certifications, or former professional experience as a Senior or Principal Forensic Consultant, Senior or Principal Cybersecurity Consultant, or as a Senior or Principal Incident Responder. 
  • Hold industry certifications or showcase equivalent professional experience as a Principal Consultant, highlighting a profound mastery of Digital Forensics and Incident Response. 
  • Previous experience in leading the forensic workstreams and teams ranging from 3-4 in size on complex investigations. 
  • Demonstrate advanced proficiency in utilizing common digital forensic artifacts and tools such as ELK, Axiom, Encase, FTK (Forensic Toolkit), Open-Source, or comparable industry-standard tools.
  • Showcase professional experience in the effective use of network analysis and intrusion detection tools, exemplifying a deep understanding of their application in cybersecurity. 
  • Possess in-depth knowledge of cybersecurity principles and best practices, underlining a comprehensive understanding of the intricacies of the cybersecurity landscape. 
  • Exhibit excellent problem-solving skills and meticulous attention to detail, displaying an ability to navigate complex challenges with precision and thoroughness. 
  • Demonstrate the ability to work effectively under pressure, manage multiple competing priorities, and consistently meet tight deadlines, reflecting resilience and efficiency in high-stakes scenarios. 
  • Display exceptional communication skills, both written and verbal, ensuring the ability to convey complex technical information clearly and comprehensively. 
  • Express eagerness to mentor, share knowledge, and actively contribute to the expansion of the team's expertise, fostering a collaborative and growth-oriented environment. 
  • Exhibit the capability to provide after-hours (on-call/weekend rotational) support as required, demonstrating a commitment to addressing critical incidents promptly and maintaining continuous coverage.

Interview Process

  • Submit interest and application to on our website
  • Preliminary phone interview with the the Talent & People Team (approx., 30 minutes)
  • Virtual /Teams Technical interview with DFIR Consultants (approx., 60 minutes)
  • Virtual/Teams interview with Engagement Leads (approx., 60 minutes)
  • Virtual/Teams interview with Chief Delivery Officer (approx., 45 minutes)
  • Virtual/Teams interview with CEO (Chief Executive Officer) (approx., 30 minutes)

Please note that we reserve the right to modify the process at any time.

 

Benefits of Joining Surefire Cyber

  • Competitive compensation plan and total rewards package for team members
  • Remote workforce
  • Generous paid time off plan and floating holidays
  • Paid parental leave
  • Employer paid premiums for both team members and their dependents for medical, dental, and vision
  • Comprehensive health, vision, dental, 401K matching program, disability, Flexible Spending Accounts (FSA), Health Savings Account (HSA), Life and AD&D benefits.
  • Professional development and career advancement opportunities
  • We prioritize employee growth and development through a robust performance management platform to provide ongoing coaching, clear feedback, recognition, and opportunities for career growth.

Surefire Cyber is an Equal Opportunity Employer that does not discriminate on the basis of actual or perceived race, color, creed, religion, national origin, ancestry, citizenship status, age, sex, or gender (including pregnancy, childbirth, and pregnancy-related conditions), gender identity or expression (including transgender status), sexual orientation, marital status, military service and veteran status, physical or mental disability, genetic information, or any other characteristic protected by applicable federal, state or local laws and ordinances.

Apply for this job

*

indicates a required field

Resume/CV

Accepted file types: pdf, doc, docx, txt, rtf

Cover Letter

Accepted file types: pdf, doc, docx, txt, rtf


Select...
Select...

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Surefire Cyber’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Select...
Select...
Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...

Voluntary Self-Identification of Disability

Form CC-305
Page 1 of 1
OMB Control Number 1250-0005
Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

  • Alcohol or other substance use disorder (not currently using drugs illegally)
  • Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
  • Blind or low vision
  • Cancer (past or present)
  • Cardiovascular or heart disease
  • Celiac disease
  • Cerebral palsy
  • Deaf or serious difficulty hearing
  • Diabetes
  • Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
  • Epilepsy or other seizure disorder
  • Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
  • Intellectual or developmental disability
  • Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
  • Missing limbs or partially missing limbs
  • Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
  • Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
  • Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
  • Partial or complete paralysis (any cause)
  • Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
  • Short stature (dwarfism)
  • Traumatic brain injury
Select...

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.