Digital Forensics Lead – Incident Response

RSI Security

Digital Forensics & Incident Response Lead managing high-stakes engagements such as data breaches and ransomware response. Delivering expert forensic reporting and strategic guidance to secure client infrastructures.

Posted 7/8/2026contractRemote • 🇺🇸 United StatesSenior💰 $100 per hourWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in digital forensics and incident response, with a strong focus on evidence integrity, advanced analytical techniques, and adherence to NIST guidelines. Proficient in utilizing the MITRE ATT&CK® framework for threat detection and response strategies.

Highest-signal resume keywords

Digital ForensicsIncident ResponseNetwork Traffic AnalysisAdvanced Security CertificationsNIST SP 800-86 Mastery

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Digital Evidence AcquisitionMalware TriageMemory ForensicsAutomation (Python, PowerShell, Bash)Containment Strategies

Soft Skills

Analytical ThinkingAdvisory Services

Tools & Technologies

MITRE ATT&CK® FrameworkForensic Tools

Certifications & Qualifications

GCFAGCIHGNFACISSP

Industry Keywords

Chain of CustodyForensic SoundnessOperational ContinuityPublic Trust EligibilityTop Secret Clearance

Tech Stack

Tools & technologies

PythonTypeScript

About the role

Key responsibilities & impact

Execute the end-to-end forensic process—collection, examination, analysis, and reporting—ensuring technical rigor and evidentiary integrity.
Oversee the identification and acquisition of digital evidence from diverse sources while maintaining a strictly documented chain of custody and forensic soundness.
Correlate observed behaviors against the MITRE ATT&CK® framework to pinpoint defensive gaps, validate existing controls, and enhance detection engineering.
Architect containment strategies that balance operational continuity with the need to isolate threats and preserve volatile evidence during active incidents.
Provide advanced analytical response and advisory services during high-severity security events, subject to the Consultant's availability and a mutually agreed-upon task order.

Requirements

What you’ll need

Minimum of 7–10 years of demonstrable experience in digital forensics, incident response, network traffic analysis, and malware triage as an independent consultant or agency.
Must hold active, advanced security and forensic certifications (e.g., GCFA, GCIH, GNFA, CISSP, or equivalent).
Public Trust eligibility is required; Active Secret clearance is highly preferred, with the ability to obtain a Top Secret (TS/SCI) clearance if dictated by specific engagement task orders.
The Consultant (and any personnel deployed by the Consultant) must successfully pass a comprehensive multi-jurisdictional background check prior to accessing sensitive RSI Security or client infrastructure.
Mastery of NIST SP 800-86 guidelines, enterprise network architecture, memory forensics, and advanced automation (Python, PowerShell, Bash).

Benefits

Comp & perks

Proactive Communication: Translate complex attack narratives into clear, actionable reporting for both technical and non-technical audiences.
Data Security & Privacy: Maintain rigorous operational security (OPSEC) over all client data, utilizing encrypted channels and immediately relinquishing access and data upon project completion.