Principal Consultant, DFIR, Reactive Services (Unit 42) - Remote

As a Principal Consultant at Palo Alto Networks, you will lead incident response engagements, providing expert guidance to enhance clients' security posture.

Description

• Manage and lead incident response engagements, including scoping work and guiding clients through forensic investigations.
• Perform reactive incident response and host-based analysis on Windows, Linux, and Mac OS X systems to identify Indicators of Compromise (IOCs).
• Examine firewall, web, database, and other log sources to identify evidence of malicious activity and attack vectors.
• Investigate data breaches using forensic tools like EnCase, FTK, X-Ways, SIFT, and Splunk.
• Provide clients with clear, actionable recommendations for long-term remediation and security posture improvement.
• Collaborate with internal teams and external stakeholders to ensure alignment and deliver comprehensive solutions.

Requirements

• Bachelor's degree with 8 years of experience, or Master's degree with 6 years of experience, or PhD with 3 years of experience in Information Security, Computer Science, Digital Forensics, or a related field.
• Must speak English and Spanish; Portuguese is a plus.
• Direct experience in incident response or digital forensics consulting.
• Proficiency with host-based forensics and data breach response methodologies.
• Hands-on experience with forensic tools such as EnCase, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, or WireShark.
• Ability to travel as needed to meet business demands, averaging up to 20%.