> Markdown version of [/jobs/ext/3553348-director-digital-forensics-and-incident-response](https://www.wearedevelopers.com/jobs/ext/3553348-director-digital-forensics-and-incident-response). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Director, Digital Forensics and Incident Response

- **Company:** BlueVoyant
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Amazon Web Services, Microsoft Azure, Bash Shell, Software as a Service, Cloud Computing, Cyber Security, Python (Programming Language), Network Forensics, Windows PowerShell, Kusto Query Language, SQL Databases, Okta, Information Technology, Gsuite, Encase, Splunk
- **Published:** October 2, 2026
- **Apply:** https://www.thejobnetwork.com/job/99940082-4a3a-433d-8100-6fc9aadefe9a/senior-director-digital-forensics-and-incident-response

## About the Role

* 3-5 years of hands-on DFIR experience in real-world incidents
 * 6-10 years in client-facing consulting, incident response, or cyber advisory roles
 * Proven experience as an incident commander or senior DFIR lead
 * Strong background in ransomware, cloud/identity compromise, and complex attack investigations
 * Experience working directly with executives, legal counsel, insurers, and technical teams
 * Ability to manage multiple stakeholders, workstreams, and timelines under pressure
 * Leadership experience mentoring or managing technical teams

Technical Expertise:

 * Strong knowledge across endpoint, cloud, identity, SaaS, and network forensics
 * Experience with tools such as EnCase, FTK, Magnet AXIOM, Velociraptor, Splunk, Sentinel, CrowdStrike (or similar)
 * Familiarity with Microsoft 365, Entra ID, Azure, AWS, Okta, Google Workspace
 * Understanding of attacker tradecraft, including persistence, lateral movement, and data exfiltration
 * Working knowledge of KQL, SPL, SQL, PowerShell, Python, or Bash

Leadership & Communication:

 * Exceptional communication skills-able to translate technical issues into business impact
 * Strong judgment in high-stress, ambiguous environments
 * Composed, credible, and client-focused under pressure
 * Collaborative leader with a focus on quality, mentorship, and outcomes

Nice to Have:

 * Experience working with breach counsel, insurers, or regulators
 * Incident readiness, tabletop, or IR planning experience
 * Certifications such as CISSP, GCFA, GCIH, GCFE, GNFA, OSCP

Education:

Bachelor's degree preferred (Cybersecurity, Computer Science, DFIR, or related), or equivalent professional experience.

## Description

BlueVoyant is seeking a Senior Director, DFIR to lead high-impact cyber investigations and act as incident commander during complex, high-pressure security incidents.

This is a client-facing leadership role responsible for guiding organizations through critical moments-from initial response through investigation, containment, and recovery-while advising executives, legal counsel, and technical teams.

What You'll Do:

 * Act as incident commander for complex DFIR engagements end-to-end
 * Serve as the primary client lead, advising executives, legal counsel, insurers, and stakeholders
 * Lead investigations across ransomware, BEC, cloud/identity compromise, insider threat, and advanced attacks
 * Direct forensic analysis across endpoints, cloud, identity, SaaS, email, and network environments
 * Translate technical findings into clear business risk and remediation guidance
 * Lead executive briefings, client updates, and post-incident reviews
 * Manage multiple concurrent incidents in fast-paced, high-pressure environments
 * Mentor and develop DFIR consultants and technical teams
 * Support incident readiness, tabletop exercises, and client growth initiative.