Senior Incident Responder - Detection & DFIR

We need an experienced responder who has handled serious, real-world security incidents, not just coordinated incident tickets.

What we need:

• 10+ years in security with deep hands-on incident response experience.
• Experience leading response to ransomware, identity compromise, BEC, cloud account takeover, data exfiltration and other high-severity incidents.
• Strong hands-on knowledge of CrowdStrike Falcon, RTR, Falcon Next-Gen SIEM/LogScale, Entra ID and Azure.
• Windows/Linux forensics, memory analysis, timeline reconstruction and evidence preservation.
• Familiarity with tools such as Falcon Forensics, Velociraptor, KAPE and Volatility.
• Strong knowledge of AD and identity attacks including Kerberoasting, DCSync, pass-the-hash, token theft and consent phishing.
• Ability to convert incident learnings into improved detections, playbooks and threat hunts.