PLAID ELITE DFIR Consultant

The role

You will lead emergency incident response engagements end to end using the 7AI platform. You will perform enterprise investigations across host, network, cloud, SaaS, and application evidence while validating AI-driven findings.

What you will do

• Run scoping calls with clients, breach counsel, and cyber insurance carriers.
• Manage engagements end to end including planning, collection, timeline, and budget.
• Lead and personally perform enterprise investigations across host, network, cloud, SaaS, and application evidence.
• Serve as the escalation point for PLAID ELITE analysts and mentor them.
• Collect and analyze evidence through the 7AI platform and Velociraptor.
• Validate and test AiDFIR output against source evidence.
• Build platform skills and develop tooling to improve investigative workflow.
• Own deliverables for client and counsel including interim updates and final reports.
• Handle evidence to defensible standards including chain of custody.
• Feed lessons learned back into methodology, playbooks, and platform.

Required qualifications

• 8+ years of digital forensics and incident response experience, including leading client-facing engagements at a consultancy or IR firm.
• Track record of leading emergency IR engagements directed by breach counsel and cyber insurance carriers.
• Deep enterprise forensics expertise across host-based (Windows, macOS, Linux), network, cloud (AWS, Azure, GCP), SaaS (Microsoft 365, Google Workspace), and application evidence.
• Experience with memory analysis and large-scale log correlation.
• Hands-on Velociraptor experience, including writing VQL artifacts.
• Scripting in Python, PowerShell, or similar.
• Working knowledge of malware analysis.
• Experience querying SIEM and EDR data with KQL, SPL, FQL, or SQL.
• Sound judgment evaluating automated or AI-generated analysis.
• Excellent written and verbal communication.
• A calm, decisive presence in a crisis.

Nice to have

• GIAC certifications (GCFA, GCFE, GNFA, GREM, GCIH)
• CISSP
• Prior experience in a managed detection and response (MDR) environment

About the company

7AI is the foundational AI security company founded in 2024 by Cybereason co-founders. The platform pairs a federated SIEM with AI agents to detect, investigate, respond, and hunt.