DFIR – Engagement Manager

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a DFIR - Engagement Manager based in the United States.

The DFIR - Engagement Manager will lead complex digital forensics and incident response engagements for organizations facing active and high-impact cyber threats.

This role owns the engagement lifecycle from initial scoping and staffing through delivery, budget management, escalation, and closure.

You will coordinate closely with forensic and incident response practitioners while serving as a trusted point of contact for customers and senior stakeholders.

The position requires the ability to move confidently between technical investigations and executive-level conversations during high-pressure incidents.

You will help shape investigative direction, validate findings, communicate business impact, and ensure response activities meet rigorous quality and reporting standards.

The role combines cybersecurity consulting, project leadership, client management, and hands-on technical support when additional investigative capacity is needed.

You will operate in a fast-moving environment where strong judgment, communication, collaboration, and technical expertise directly contribute to helping organizations respond to sophisticated cyber incidents.

Accountabilities:

• Lead active digital forensics and incident response engagements end-to-end, ensuring high-quality delivery, timely outcomes, effective resource allocation, and adherence to engagement scope.
• Staff analysts based on engagement requirements, technical expertise, and availability while monitoring team capacity and balancing workloads across active investigations.
• Lead engagement scoping and business development activities, including incident intake, requirements gathering, statements of work, and three-party engagement documentation.
• Manage engagement retainer-hour budgets, monitor usage against scope, and coordinate additional-hour or overage discussions with customers and account teams.
• Establish clear communication channels across investigation stakeholders, including customers, internal teams, account teams, external breach counsel, and cyber insurance carriers.
• Own technical and operational escalations through resolution, ensuring challenges are addressed efficiently and investigative momentum is maintained.
• Oversee case documentation, evidence handling, chain of custody, and retention and deletion requirements through engagement closure, including customer requests for early deletion.
• Partner with technical leads to define investigative direction, align on analytical priorities, validate findings, and ensure workstreams meet customer expectations and reporting standards.
• Ensure investigations follow established standard operating procedures, incident response methodologies, evidence-handling practices, and quality standards.
• Deliver accurate and timely status updates, findings, recommendations, and other communications throughout the engagement lifecycle.
• Provide hands-on surge support for data collection, forensic analysis, and related technical activities when additional practitioner capacity is required.
• Lead post-engagement reviews and identify opportunities to improve workflows, processes, quality, and overall team effectiveness.
• Participate in a rotating on-call schedule covering weekends and holidays to support active incident response engagements.

Requirements

• 5+ years of hands-on consulting experience in digital forensics and incident response, including engagement or project management responsibilities within cybersecurity consulting or incident response services.
• Bachelor’s or Master’s degree in Digital Forensics, Cybersecurity, Computer Science, or a related technical field, or equivalent practical experience and self-directed study.
• Relevant industry certifications such as GCFE, GCFA, GREM, CFCE, EnCE, or similar credentials are preferred.
• Proven experience managing complex, multi-stakeholder incident response engagements from initiation through completion.
• Strong client communication and relationship-management skills, with confidence working with executive stakeholders, legal counsel, cyber insurance carriers, and technical teams.
• Ability to translate complex forensic and technical findings into clear business impact and actionable recommendations for non-technical stakeholders.
• Expert-level knowledge of industry-standard digital forensic tools, investigation methodologies, and incident response practices.
• Strong understanding and practical experience with EDR/XDR platforms and broader cybersecurity technologies.
• Strong staffing, resource coordination, project management, and team leadership capabilities.
• Demonstrated ability to work independently, take initiative, and make sound decisions in high-pressure and rapidly changing environments.
• Intellectual curiosity and a commitment to continuous learning, with the ability to adapt to emerging technologies, investigative techniques, and evolving cyber threats.
• U.S. citizenship and FedRAMP eligibility are required to support certain customer investigations.
• Experience with malware analysis and memory forensics is a plus.
• Experience conducting endpoint-based threat hunting and compromise assessments is a plus.
• Familiarity with cyber threat intelligence platforms and processes is a plus.
• Active participation in the cybersecurity community through speaking engagements, publications, or similar activities is a plus.

Benefits

• Base salary range of $132,000-$160,000 USD, with the applicable range varying based on candidate location.
• Restricted Stock Units (RSUs).
• Employee Stock Purchase Plan (ESPP).
• Flexible time off.
• Paid company holidays and paid sick time.
• Gender-neutral parental leave.
• Grandparent leave.
• Medical, dental, and vision coverage.
• 401(k) retirement plan with company match.
• Life and disability insurance.
• Health and dependent care FSA options.
• Voluntary benefits, including hospital, accident, and critical illness coverage.
• Employee Assistance Program (EAP).
• Pre-paid legal services.
• Nationwide pet insurance.
• Cancer Care program.
• Global business travel medical insurance.
• Home office allowance.
• Mobile phone reimbursement.
• Wellness coaching and gym/wellness reimbursement.
• Fertility coverage.
• Adoption and surrogacy reimbursement.
• Opportunity to work on high-impact incident response engagements involving sophisticated cyber threats and complex enterprise environments.
• U.S.-based role covering Pacific, Mountain, Alaska, or Hawaii time zones.
• Equal employment opportunity and affirmative action workplace committed to an inclusive environment.