OverviewWe are seeking a PLAID ELITE DFIR Consultant to join the DFIR team in Professional Services, part of PLAID ELITE, reporting to the Head of DFIR. You will lead emergency incident response engagements end to end, from the first scoping call to the final report for client and counsel, delivering people-led, AI-driven forensics on the 7AI platform.
You will investigate hands-on while shaping how we investigate: writing Velociraptor artifacts, building platform skills, and validating the AI that does the heavy lifting, so every finding we deliver is fast, evidence-based, and defensible.
What you'll do- Run scoping calls with clients, breach counsel, and cyber insurance carriers to define each engagement's scope, objectives, and deliverables.
- Manage engagements end to end: plan the investigation, coordinate collection, track timeline and budget, and keep client and counsel updated on a steady cadence.
- Lead and personally perform enterprise investigations across host, network, cloud, SaaS, and application evidence, including ransomware, business email compromise, data theft, and intrusion matters.
- Serve as the escalation point for PLAID ELITE analysts when a case needs forensic collection, malware analysis, or root-cause determination, and mentor them through the investigation.
- Collect and analyze evidence through the 7AI platform and Velociraptor, writing and maintaining the VQL artifacts each case needs.
- Validate and test AiDFIR output: review AI-driven findings against source evidence for accuracy, completeness, and risk, flag errors and uncertainty, and keep expert human judgment on every conclusion that reaches a client.
- Build platform skills and develop tooling that improve the speed, consistency, and quality of our investigative workflow.
- Own deliverables for client and counsel, including interim updates, findings briefings, and final reports that tell the story of the incident clearly for executives, attorneys, and engineers alike.
- Handle evidence to defensible standards, including chain of custody, and work within privilege as directed by counsel.
- Feed lessons learned from every engagement back into our methodology, playbooks, and platform.
- Work with Engineering and Product to share what you see in the field and shape the 7AI platform and AiDFIR roadmap.
- Participate in an on-call rotation to support emergency response.
Requirements- 8+ years of digital forensics and incident response experience, including leading client-facing engagements at a consultancy or IR firm.
- A track record of leading emergency IR engagements directed by breach counsel and cyber insurance carriers, from scoping through delivery of findings to counsel.
- Deep enterprise forensics expertise across host-based (Windows, macOS, Linux), network, cloud (AWS, Azure, GCP), SaaS (Microsoft 365, Google Workspace), and application evidence, including memory analysis and large-scale log correlation.
- Hands-on Velociraptor experience, including writing VQL artifacts, with scripting in Python, PowerShell, or similar.
- Working knowledge of malware analysis, and experience querying SIEM and EDR data with KQL, SPL, FQL, or SQL.
- Sound judgment evaluating automated or AI-generated analysis: knowing when to trust it, how to test it, and when to go back to the raw evidence.
- Excellent written and verbal communication, with reports and briefings that executives, counsel, and engineers can all act on.
- A calm, decisive presence in a crisis: able to run a scoping call, a ransomware investigation, and a counsel briefing in the same day, including on-call.
Nice to have- GIAC certifications (GCFA, GCFE, GNFA, GREM, GCIH) and/or CISSP.
- Prior experience in a managed detection and response (MDR) environment.
