Lead DFIR Responder

Overview

When an organisation faces a serious incident — ransomware, nation-state intrusion, insider threat, or financial fraud — Enovise is called in to contain, investigate, and recover. As Lead DFIR Responder, you will take command of complex, high-pressure investigations across the Americas region. You will lead multi-disciplinary response teams, manage client communications during active incidents, and produce forensic findings that hold up to legal, regulatory, and executive scrutiny. This role requires the ability to operate calmly under extreme time pressure, make fast decisions with incomplete information, and drive resolution without losing rigour.

Responsibilities

• Lead end-to-end incident response engagements from initial triage through containment, eradication, and recovery.
• Conduct forensic analysis across Windows, Linux, macOS, cloud, and mobile environments.
• Direct live response across distributed enterprise environments, coordinating remote and on-site responders.
• Produce court-admissible forensic reports and provide expert witness testimony where required.
• Brief C-suite and legal teams during active incidents with clarity, composure, and precision.
• Develop and maintain response playbooks, tooling standards, and forensic methodologies for the DFIR practice.
• Mentor junior responders and build internal capability through structured coaching and post-incident review.

Requirements

• 6+ years of DFIR experience with a track record of leading complex, high-stakes investigations.
• Deep forensic expertise across endpoint, network, memory, and cloud (AWS, Azure, or GCP) environments.
• Strong experience with forensic tooling: Velociraptor, Axiom, X-Ways, Volatility, or equivalent.
• Ability to reverse-engineer attacker TTPs from forensic artefacts and reconstruct full attack timelines.
• Experience managing client stakeholders, legal counsel, and law enforcement during live incidents.
• Willingness to operate on an on-call rotation and deploy on short notice across the Americas.
• GCFE, GCFA, GCFR, CREST CFIA, or equivalent certification.

Nice to Have

• Experience with OT/ICS incident response in industrial or energy environments.
• Prior engagement with law enforcement, regulatory bodies, or legal proceedings as an expert witness.
• Familiarity with cyber insurance claim investigations and breach notification requirements.
• Experience leading responses to nation-state intrusion campaigns.