> Markdown version of [/jobs/ext/596627-lead-consultant-1099-ir-forensics-practice](https://www.wearedevelopers.com/jobs/ext/596627-lead-consultant-1099-ir-forensics-practice). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Consultant (1099): IR/Forensics Practice - **Company:** Lumifi Cyber, Inc. - **Location:** Arlington, VA, United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Cloud Computing, Computer Networks, Linux, Intrusion Detection Systems, Network Forensics - **Published:** June 20, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=f2c9e5736edad129 ## About the Role Do you have experience in Technical report writing?, * 5+ years of experience in incident response and forensic investigations * Experienced in disk, M365, cloud and network investigations and forensics, required * Proficient at IR/Forensics and TTE After-Action Report writing, required * Strong analytical and problem-solving skills with the ability to tackle complex challenges. * Effective communication skills, both written and verbal, to document and share knowledge. * Ability to adapt and thrive in a fast-paced, evolving technical landscape. * Proven ability to problem-solve and think critically in a fast-paced environment. ## Description The Lead Consultant will be part of the Incident Response and Forensics practice, whose services include emergency incident response as well as incident preparation services. The Lead Consultant will act as an Incident Commander on customer incidents, perform forensic investigation activities during suspected security events, manage customer recovery, and provide expert incident response reports. Skills include resolving highly complex intrusion scenarios using host, cloud, network, log, IDS and device analysis and forensics. As a Lead Consultant you will respond to, analyze, diagnose, and report on attack events as well as recommend counter measures to attacks and other malicious activity. Lead Consultants must also be able to develop IR Plans and Playbooks and run IR Tabletop Exercises. Duties and Requirements * Available 24/7 for incoming IR work, based on an on-call rotation of 2 weeks on, 4 weeks off on-call rotation * Mostly remote work but some infrequent emergency travel is required * Able to act as an Incident Commander for customers, lead a response and recovery effort on their behalf * Assist and lead in the creation of IR Plan and Playbook Development * Develop policies and procedures to investigate malware incidents for the entire computer network * Assists in the development and delivery of malware security awareness products and briefings * Lead in IR Tabletop Exercises Good to have: * CISSP/CISM * GIAC Certified Forensic Examiner (GCFE), GIAC Experienced Forensics Examiner (GX-FE), GIAC Enterprise Incident Response (GEIR), GIAC Cloud Forensics Responder (GCFR), GIAC Certified Forensic Analyst (GCFA), GIAC Network Forensic Analyst (GNFA), GIAC Certified Incident Handler Certification (GCIH), GIAC Response and Industrial Defense (GRID), GIAC Experienced Forensics Analyst (GX-FA), GIAC Linux Incident Responder (GLIR) * Experience with standards framework assessments ## Related Videos - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Distributed search under the hood](https://www.wearedevelopers.com/videos/256-distributed-search-under-the-hood) - [Green Cloud Computing](https://www.wearedevelopers.com/videos/592-green-cloud-computing) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [WebAssembly: The Next Frontier of Cloud Computing](https://www.wearedevelopers.com/videos/972-webassembly-the-next-frontier-of-cloud-computing) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)