Principal Consultant, DFIR, Reactive Services – LATAM

This is a fully remote position, open to applicants in Brazil, +1 more country.

📋 Description

• Oversee and carry out intricate digital forensics and incident response investigations in enterprise settings.

• Act as a technical lead during investigations involving ransomware, business email compromise, malware, insider threats, unauthorized access, data theft, and advanced intrusions.

• Execute advanced forensic analysis of endpoints, systems, logs, networks, and cloud infrastructures.

• Direct host, network, identity, and cloud investigations during active incidents.

• Conduct and supervise forensic acquisition, preservation, and analysis while adhering to chain-of-custody protocols.

• Utilize DFIR tools, investigative techniques, and threat intelligence to aid in containment, eradication, and recovery efforts.

• Manage technical workflows and coordinate efforts among client teams, internal stakeholders, and third-party partners.

• Interpret technical findings into investigative summaries, timelines, executive briefings, and reports for clients.

• Present findings and recommendations to technical teams, business leaders, legal counsel, and executives.

• Offer remediation advice throughout the incident response and recovery phases.

• Mentor junior and mid-level consultants.

• Assist in engagement planning, scoping, quality assurance, delivery, business development, client briefings, and technical discussions.

• Contribute to internal DFIR processes, playbooks, tools, training materials, and knowledge-sharing initiatives.

• Stay informed about emerging threats, attacker techniques, forensic methodologies, and cybersecurity trends.

• Travel up to 20% across Latin America for client engagements.

⛳️ Requirements

• Bachelor's degree in Computer Science, Information Security, Digital Forensics, or a related field, or equivalent practical experience.

• 6–8 years of direct experience in Digital Forensics and Incident Response, Security Operations, SOC, threat hunting, or related cybersecurity areas.

• Proven experience leading or managing complex enterprise incident response investigations independently.

• Background in investigating ransomware, intrusion incidents, phishing, malware, business email compromise, insider threats, data theft, or unauthorized access cases.

• Strong understanding of forensic methodologies, evidence handling, forensic acquisition techniques, and chain-of-custody practices.

• Practical experience with EnCase, FTK, Sleuth Kit, Volatility, Velociraptor, X-Ways, Magnet AXIOM, or similar forensic frameworks.

• Experience in investigating Microsoft Windows, Linux, and macOS environments.

• Proficient in analyzing endpoint, network, identity, cloud, and security-platform data.

• Knowledge of attacker techniques, persistence mechanisms, lateral movement, credential access, and indicators of compromise.

• Strong analytical and problem-solving capabilities.

• Excellent written and verbal communication skills.

• Ability to convey complex technical findings to both technical and executive audiences.

• Capacity to manage client relationships and offer trusted technical advice during critical incidents.

• LATAM candidates must be fluent in English and Spanish, English and Portuguese, or Spanish and Portuguese; proficiency in all three languages is preferred.

• Ability to effectively communicate with clients and internal teams throughout Latin America.

• Preferred: experience with cloud, hybrid, or multinational investigations; familiarity with MITRE ATT&CK; malware analysis; threat hunting; EDR; AWS; Microsoft Azure; Google Cloud Platform; Microsoft 365; cybersecurity consulting; managed security services; MDR; incident response organizations; mentoring; concurrent investigations; relevant industry certifications; and experience with multinational or enterprise clients in Latin America.

• Willingness to travel up to 20% across Latin America.

• Applicants must not require immigration sponsorship; the employer will not provide work visa sponsorship.

🏝️ Benefits

• Flexible remote work arrangement

• Travel support for client engagements (up to 20% throughout Latin America)

• Reasonable accommodations for qualified individuals with disabilities

• Immigration sponsorship is not available