Principal DFIR Consultant

🔥 14 hours ago

🇺🇸 United States – Remote

💵 $230k - $300k / year

⏰ Full Time

🔴 Lead

💼 Consultant

👻 Ghost score 6%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

MOXFIVE

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2019

💼 Consulting

🏥 Healthcare

🛡️ Insurance

Consulting • Healthcare • Insurance

MOXFIVE is a cybersecurity incident response and resilience provider that helps organizations rapidly manage ransomware attacks and other cyber incidents. They combine a proprietary platform with expert Technical Advisors to centralize incident management, forensics, recovery, and remediation while providing visibility into milestones, costs, and workstreams. MOXFIVE also delivers advisory services to improve security posture and business resilience, and serves enterprise and SMB clients through B2B engagements.

📋 Description

• Respond to and investigate threat activity as an incident response consultant • Support and lead forensic investigations for ransomware and nation-state threats • Investigate traditional enterprise and cloud-native environments • Handle multi-cloud intrusions across AWS, GCP, and Azure • Investigate identity and API abuse, account takeovers, and suspicious cloud activity • Use AI-assisted tooling to accelerate investigation and reporting while maintaining forensic rigor • Help shape the logic, prompts, and guardrails of an LLM-based investigative platform • Contribute to MOXFIVE’s technology stack, investigative methodology, and service offerings • Apply investigative judgment and casework insights to improve internal tooling

🎯 Requirements

• Experience responding to threat activity as an IR consultant or SOC analyst • Strong understanding of Windows, Mac, and Linux fundamentals • Knowledge of forensic artifacts and network analysis • Existing knowledge or passion to learn cloud-native investigations across AWS, GCP, and Azure • Familiarity with AWS CloudTrail and VPC Flow Logs • Familiarity with GCP Admin Activity and Data Access logs • Familiarity with Entra ID/M365 audit logs • Curiosity about LLMs and AI-assisted tooling for investigations and reporting • Interest in helping shape an internal LLM-based investigative platform • Unwavering emphasis on investigation quality