Principal Consultant, Cloud DFIR

🕒 Yesterday

🔔 Pennsylvania – Remote

🔔 Pennsylvania – Remote

💵 $151k - $208k / year

⏰ Full Time

🔴 Lead

💼 Consultant

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

Apply Now

Find Similar Remote Jobs

Receive Emails For Remote Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Palo Alto Networks

WebsiteLinkedInAll Job Openings

10,000+ employees

🔒 Cybersecurity

🏢 Enterprise

💰 $1M Seed Round - Morta Security on 2013-02

Cybersecurity • Enterprise

Palo Alto Networks is a global cybersecurity company that provides AI-driven platforms, products, and services to protect networks, cloud workloads, endpoints, and applications. Its portfolio includes next-generation firewalls, SASE and Prisma Cloud (CNAPP) offerings, the Cortex security operations suite (XDR, XSOAR, XSIAM), and Unit 42 threat intelligence and incident response services. Palo Alto Networks helps enterprises secure AI deployments, automate SOC workflows, and prevent, detect, and respond to sophisticated threats across hybrid and multi-cloud environments.

📋 Description

• Lead cloud-focused incident response and digital forensics engagements. • Investigate attacks involving cloud infrastructure, identity compromise, ransomware, data theft, and unauthorized access. • Analyze cloud telemetry, including audit logs, IAM activity, network traffic, storage access, containers, and endpoint data. • Conduct forensic acquisition and analysis across cloud, hybrid, and enterprise environments. • Serve as a technical lead during active investigations, guiding strategy and client communications. • Deliver clear findings, executive-ready reporting, and remediation guidance. • Support development of cloud investigation methodologies, playbooks, and tooling. • Mentor team members and contribute to knowledge sharing across Unit 42.

🎯 Requirements

• 6–8+ years of experience in DFIR, incident response, cloud security, or related cybersecurity disciplines. • 3+ years of hands-on experience securing, operating, or investigating AWS, Azure, or GCP environments. • Experience leading investigations involving cloud breaches, ransomware, advanced intrusions, or data compromise incidents. • Strong understanding of cloud architecture, IAM, networking, logging, and security controls. • Experience analyzing cloud-native telemetry such as AWS CloudTrail, Azure Activity Logs, Microsoft Entra ID, or Google Cloud Audit Logs. • Hands-on experience with industry-standard DFIR and investigative tools. • Experience investigating Windows, Linux, macOS, cloud workloads, and hybrid environments. • Strong client-facing communication and consulting skills.

🏖️ Benefits

• Employee benefits may be found here.