Principal DFIR Consultant - Remote (Anywhere in the U.S.)

The role

The Principal DFIR Consultant serves as the highest individual contributor and foremost technical authority within the DFIR Practice. This person leads complex, high-severity investigations and shapes practice operations through methodology development and staff mentorship.

What you will do

• Serve in the Oversight role on complex or high-severity engagements
• Lead critical investigations including ransomware, APT, nation-state, and insider threats
• Conduct advanced host forensics, network analysis, malware reverse engineering, cloud forensics, and threat actor attribution
• Design, document, and maintain DFIR investigation methodologies, playbooks, and SOPs
• Mentor Senior Consultants and Analysts
• Lead internal training sessions and write technical blog posts and research
• Design and build automation, scripts, or integrations to improve efficiency
• Participate in candidate screening and technical interviews
• Support pre-sales activities including technical scoping and proposal development
• Represent GuidePoint Security externally through presentations and publications

Required qualifications

• 8+ years of hands-on DFIR experience, including complex incident response and forensic investigations
• 10+ combined years of IT and information security experience
• Demonstrated experience in a Lead or senior technical role on high-severity engagements
• Expert-level proficiency in host forensics, network forensics, log analysis, malware triage, cloud IR, and BEC investigation
• Exceptional written and verbal communication skills
• Proven track record of mentoring and developing junior and mid-level technical staff
• Experience developing or contributing to DFIR methodologies, playbooks, or tooling
• Embraces emerging technologies, including AI tools

Nice to have

• Prior consulting or professional services experience at a leading DFIR or cybersecurity firm
• Advanced proficiency with scripting and tooling: PowerShell, Python, Bash, Go, or similar
• Experience building custom investigative tools
• Deep experience with EDR, NDR, XDR, SIEM, Velociraptor, and commercial/open-source forensic platforms
• Cloud incident response expertise: AWS, Microsoft 365, Azure, Google Workspace
• Experience with threat actor attribution, CTI integration, and intelligence-driven investigation
• Familiarity with ransomware negotiation considerations, threat actor communications, and recovery workflows
• External thought leadership: conference talks, published research, blog posts, or community contributions
• Relevant certifications: GREM, GCFA, GCFE, GDAT, GCIH, GCIA, CISSP, or equivalent

Benefits

• Group Medical Insurance options
• Group Dental Insurance
• 12 corporate holidays
• Flexible Time Off (FTO) program
• Healthy mobile phone and home internet allowance
• Eligibility for retirement plan after 2 months at open enrollment
• Pet Benefit Option

About the company

GuidePoint Security is a rapidly growing, profitable, privately-held value added reseller that focuses exclusively on Information Security. It serves as a trusted advisor to more than 6,200 customers.