Senior Director, Digital Forensics and Incident Response

Role: Senior Director, Digital Forensics & Incident Response
Location: Remote, US

Work Authorization: US Citizenship Required

BlueVoyant is seeking a Senior Director, DFIR to lead high-impact cyber investigations and act as incident commander during complex, high-pressure security incidents.

This is a client-facing leadership role responsible for guiding organizations through critical moments—from initial response through investigation, containment, and recovery—while advising executives, legal counsel, and technical teams.

What You’ll Do:

- Act as incident commander for complex DFIR engagements end-to-end

- Serve as the primary client lead , advising executives, legal counsel, insurers, and stakeholders

- Lead investigations across ransomware, BEC, cloud/identity compromise, insider threat, and advanced attacks

- Direct forensic analysis across endpoints, cloud, identity, SaaS, email, and network environments

- Translate technical findings into clear business risk and remediation guidance

- Lead executive briefings, client updates, and post-incident reviews

- Manage multiple concurrent incidents in fast-paced, high-pressure environments

- Mentor and develop DFIR consultants and technical teams

- Support incident readiness, tabletop exercises, and client growth initiatives

What You Bring:

- 3–5 years of hands-on DFIR experience in real-world incidents

- 6–10 years in client-facing consulting, incident response, or cyber advisory roles

- Proven experience as an incident commander or senior DFIR lead

- Strong background in ransomware, cloud/identity compromise, and complex attack investigations

- Experience working directly with executives, legal counsel, insurers, and technical teams

- Ability to manage multiple stakeholders, workstreams, and timelines under pressure

- Leadership experience mentoring or managing technical teams

Technical Expertise:

- Strong knowledge across endpoint, cloud, identity, SaaS, and network forensics

- Experience with tools such as EnCase, FTK, Magnet AXIOM, Velociraptor, Splunk, Sentinel, CrowdStrike (or similar)

- Familiarity with Microsoft 365, Entra ID, Azure, AWS, Okta, Google Workspace

- Understanding of attacker tradecraft, including persistence, lateral movement, and data exfiltration

- Working knowledge of KQL, SPL, SQL, PowerShell, Python, or Bash

Leadership & Communication:

- Exceptional communication skills—able to translate technical issues into business impact

- Strong judgment in high-stress, ambiguous environments

- Composed, credible, and client-focused under pressure

- Collaborative leader with a focus on quality, mentorship, and outcomes

Nice to Have:

- Experience working with breach counsel, insurers, or regulators

- Incident readiness, tabletop, or IR planning experience

- Certifications such as CISSP, GCFA, GCIH, GCFE, GNFA, OSCP

Education:

Bachelor’s degree preferred (Cybersecurity, Computer Science, DFIR, or related), or equivalent professional experience.

Why BlueVoyant ?
- Work alongside experienced DFIR leaders and experts , including former government cyber professionals and industry veterans.

- Lead high-impact, global cyber investigations , supporting clients through critical, business-defining incidents

- ​​​​Gain exposure to complex environments, executive stakeholders, and advanced threat scenarios across industries

- Join a global, mission-driven cybersecurity company defending organisations worldwide with cutting-edge data, technology, and expertise

- Competitive compensation and comprehensive benefits package , with support for wellbeing, development, and career growth

About BlueVoyant

BlueVoyant is an AI-driven cybersecurity company dedicated to standing between our customers and cyber threats. By combining human, artificial, and proprietary intelligence, we deliver a unified solution that protects every organization’s network, identities, vendors, and digital footprints as a single attack