DFIR Consultant

Tokio Marine HCC

DFIR Consultant investigating and responding to BEC and ransomware incidents for Vector3, an incident response firm supporting specialty insurance clients. Analyzing evidence and delivering defensible findings.

Posted 8/12/2026full-timeRemote • 🇺🇸 United StatesJuniorMid-Level💰 $87,400 - $131,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in digital forensics and incident response, with a strong focus on evidence acquisition, analysis, and reporting. Proficient in communicating complex technical information to diverse stakeholders while ensuring compliance with corporate policies and procedures.

Highest-signal resume keywords

Digital ForensicsIncident ResponseLog AnalysisDFIR ToolsReport Writing

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Evidence AcquisitionEvidence PreservationMalware AnalysisCredential Theft AnalysisData Theft InvestigationTimeline DevelopmentInvestigative ReportingStandardization of Investigative TasksOperational Efficiency ImprovementCost-Effective Controls Implementation

Soft Skills

Excellent CommunicationStakeholder EngagementMulti-Task Management

Certifications & Qualifications

CISSPCISMGCFEGCFAGREMGBFAGCIHCFCECCE

Industry Keywords

Cyber SecurityInformation TechnologySecurity OperationsIncident InvestigationEvidence Handling

Tech Stack

Tools & technologies

CloudCyber Security

About the role

Key responsibilities & impact

Perform triage, acquisition, preservation, and analysis of endpoint, server, cloud, and log evidence to determine scope, impact, and root cause
Develop accurate timelines, identify affected assets and accounts, and document investigative findings clearly and defensibly
Support analysis of malware, suspicious scripts, persistence mechanisms, credential theft, lateral movement, and data theft activity
Use repeatable methods and validated workflows to maintain evidence integrity and investigation quality
Communicate with internal stakeholders, clients, insurers, legal counsel, and other approved parties during active matters
Prepare updates, investigation notes, and report content translating technical details into actionable business and response guidance
Support status calls, evidence requests, and coordination of next steps across involved teams
Contribute to playbooks, templates, evidence handling procedures, and knowledge articles
Identify investigative tasks that can be standardized, automated, or improved for scale
Support after-action reviews and lessons learned
Contribute to short-term and long-term plans for the designated organizational area
Write or significantly contribute to investigative reports and documentation
Develop innovative ways to improve financials and operational efficiency
Comply with corporate policies and procedures and help implement cost-effective controls

Requirements

What you’ll need

Minimum 4 Year / bachelor's degree in cyber security, Computer Science, Information Technology related degree
2+ years of professional experience in digital forensics, incident response, security operations, or related investigative work
Experience performing endpoint, server, and cloud log analysis in support of cyber incidents
Experience with common DFIR tools, evidence handling, and report writing
Ability to manage multiple active matters while maintaining quality and deadlines
Excellent communication skills to clearly and concisely communicate complex technical concepts to stakeholders
Preferred advanced degrees or certifications (CISSP, CISM, GCFE, GCFA, GREM, GBFA, GCIH, CFCE, CCE) are a plus

Benefits

Comp & perks

Competitive salary and employee benefit package
Strong learning culture
Growth perspectives
6% 401K match
20 days of PTO and 2 Floating Days
Paid parental leave
An opportunity to love what you do