{"id":1972679,"url":"https://alion.io/job/cyderes-principal-consultant-dfir","title":"Principal Consultant: DFIR","company":{"id":673533,"name":"Cyderes ®","domain":"cyderes.com","url":"https://alion.io/company/cyderes","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":75,"open_postings":7,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":22,"computed_at":"2026-10-25T05:49:26Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":175000,"max":190000,"currency":"USD","period":"year","gross":null,"usd_annual":190000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ElasticSearch","optional":false},{"name":"FTK","optional":false},{"name":"ISO 27001","optional":false},{"name":"ITIL","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Windows","optional":false},{"name":"X-Ways Forensics","optional":false}],"status":"closed","first_seen_at":"2026-10-06T19:40:23Z","employer_posted_date":"2026-10-06","last_verified_at":"2026-10-21T18:10:30Z","board_verified":false,"closed_at":"2026-10-21T18:10:30Z","days_open":14,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":14},"description":"About the Role:\nThe Principal Incident Response Consultant will respond to our customer’s major information security incidents, as the lead responder or incident handler. Drawing additional resources from our technical consulting teams, the Principal will build and lead teams for the purpose of responding to and remediating active client threats. As a primary interface to customers in crisis, the Principal will have excellent communication and organizational skills, ensuring the efficient and smooth handling of incidents. The Principal will be highly skilled in collaboration.\nResponsibilities\nAct as a lead responder on high profile and sensitive customer engagements.\n\nPerforming incident triage, to include determining scope, urgency, and potential impact, identifying the specific vulnerability, and making recommendations that enable expeditious remediation\n\nBe involved in the full incident response lifecycle, from preparation for information security incidents, through detecting, managing, and resolving ongoing incidents, and finally reporting on those incidents and identifying improvements and lessons learned.\n\nCollect, triage, and analyze forensic artifacts from client networks or devices in support of incident response investigations\n\nUtilize various EDRs or log collection platforms to conduct large-scale investigations and examine endpoint and network-based sources of evidence.\n\nCommunicate with customer in a clear and precise manner throughout all phases of an incident, including verbal and written reports.\n\nAssist with developing, operating, and continuously improving the Cyderes Incident Response services.\n\nTrain, develop, coach, and supervise junior and ad-hoc responders.\n\nRequirements\nMinimum of 5 years of experience in professional services or information security field with at least 3 of those years in Incident Response\n\nHolds an industry accepted certification validating digital forensics or incident response capabilities: GCIH, GCFA, GCFE, CFCE, GREM, EnCE, CCE, or similar\n\nExperience communicating complex technical topics to both technical and non-technical audiences\n\nExperience coordinating an incident and/or leading a team during an incident\n\nExperience investigating Windows, Linux, MacOS, and cloud environments\n\nDemonstrated experience and competence in endpoint forensics, memory forensics, network forensics, and malware analysis, with specialized knowledge in at least one of those fields using tools such as Axiom, FTK, X-Ways, etc.\n\nExperience identifying indicators of compromise and threat actor activity using a hypothesis-driven approach to uncover connections and correlations in data\n\nApplied knowledge of the Incident Response Lifecycle, the Cyber Kill Chain, and the MITRE ATT&CK Framework.\n\nStrong client facing communication (report issues to customer in a timely manner, demonstrate expertise of the overall business unit and command of the incident, develop presentations to highlight results and solutions, etc.)\n\nBachelor’s degree in relevant discipline\n\nExperience working with network and security technologies to include Elasticsearch, data analytic platforms, endpoint tools, network technologies, and SIEMs\n\nProficiency with common programming or scripting languages such as Python and PowerShell\n\nAbility to preserve host-based and network evidence in an industry accepted and forensically sound manner\n\nExperience with project management to bring about the successful completion of specific project goals and objectives\n\nAbility to learn new technology and concepts quickly\n\nEffective in collaboration with teams in remote locations\n\nThe following will be considered an asset:\nCertifications such as CISSP, OSCP, ITIL, COBiT, or SABSA\n\nWorking knowledge of NIST SP800-61r2 and ISO 27035\n\nKnowledge of ISO information security standard families, particularly ISO 27001 and 27002","description_format":"text","description_chars":3860,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Security Operations"],"lifecycle":[{"event":"open","at":"2026-10-06T19:57:34Z"},{"event":"close","at":"2026-10-21T18:10:30Z"}],"visa":[],"liveness":null,"pay":{"stated_usd_annual":190000,"is_top_pay":false},"html_url":"https://alion.io/job/cyderes-principal-consultant-dfir","json_url":"https://alion.io/job/cyderes-principal-consultant-dfir.json","meta":{"generated_at":"2026-10-26T04:48:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6431,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":673533},"rest":"https://alion.io/mcp/rest/get_company?id=673533"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcyderes-principal-consultant-dfir"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcyderes-principal-consultant-dfir"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcyderes-principal-consultant-dfir"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cyderes-principal-consultant-dfir\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcyderes-principal-consultant-dfir"}]}