Principal DFIR Consultant

The role

You will support and lead incident response cases across traditional enterprise and cloud-native environments. You will also help shape an internal LLM-based investigative platform by translating investigative logic into prompts and guardrails.

What you will do

• Support and lead meaningful cases across traditional enterprise and cloud-native environments
• Investigate multi-cloud intrusions spanning AWS, GCP, and Azure
• Shape the technology stack, investigative methodology, and service offerings
• Help build an internal LLM-based investigative platform
• Translate investigative knowledge into logic, prompts, and guardrails for an LLM-based platform

Required qualifications

• Experience responding to threat activity as an IR consultant or SOC analyst
• Strong understanding of Windows/Mac/Linux fundamentals, forensic artifacts, and network analysis
• Existing knowledge or passion to learn cloud-native investigations across AWS, GCP, and Azure
• Familiarity with core log sources like CloudTrail, VPC Flow Logs, GCP Admin Activity/Data Access logs, and Entra ID/M365 audit logs
• Curiosity about how LLMs and AI-assisted tooling can accelerate investigation and reporting
• Interest in helping shape an internal LLM-based investigative platform
• An unwavering emphasis on investigation at the highest level of quality

About the company

MOXFIVE focuses on eradicating adversaries across a client's entire digital footprint using a fast, nimble approach to DFIR and AI-driven tooling.