Principal Consultant, DFIR, Reactive Services (Unit 42) - Remote

Join Palo Alto Networks as a Principal Consultant in DFIR, where you'll lead incident response and digital forensics efforts to protect clients from cybersecurity threats.

Description

• Lead and execute digital forensics and incident response investigations across enterprise environments.
• Serve as a technical lead on incident response engagements, guiding investigative strategy and forensic analysis.
• Conduct advanced host, network, and cloud investigations to identify root cause, attacker behavior, and scope of compromise.
• Perform forensic acquisition and analysis of systems, memory, logs, and endpoint telemetry.
• Utilize industry-standard DFIR tooling and methodologies to analyze malicious activity and support incident containment.
• Collaborate with Consulting Directors and cross-functional teams to deliver high-quality client outcomes during security incidents.

Requirements

• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• 6–8 years of hands-on experience in digital forensics and incident response (DFIR), security operations, or related cybersecurity disciplines.
• Demonstrated experience investigating enterprise-scale cybersecurity incidents, including ransomware, intrusion activity, or advanced persistent threats.
• Strong understanding of forensic methodologies, including evidence handling, acquisition techniques, and chain-of-custody procedures.
• Hands-on experience with industry-standard DFIR tools such as EnCase, FTK, SleuthKit, Volatility, or equivalent forensic frameworks.
• Operational experience investigating systems across major operating systems, including Microsoft Windows, Linux, and macOS.
• Strong analytical and problem-solving skills with the ability to investigate complex technical environments under pressure.
• Experience working directly with clients or internal stakeholders during security incidents.