[Hiring] Incident Commander, Digital Forensics & Incident Response @BlueVoyant

Role Description

BlueVoyant is seeking an Incident Commander, Digital Forensics & Incident Response to lead high-impact cyber investigations and take command of complex, high-pressure security incidents. This is a senior, client-facing individual contributor role with no direct reports. You'll guide organizations through critical moments, from initial response through investigation, containment and recovery, while advising executives, legal counsel and technical teams.

• Act as incident commander for complex DFIR engagements end-to-end.
• Serve as the primary client lead, advising executives, legal counsel, insurers and stakeholders.
• Lead investigations across ransomware, BEC, cloud/identity compromise, insider threat and advanced attacks.
• Perform and direct forensic analysis across endpoints, cloud, identity, SaaS, email and network environments.
• Translate technical findings into clear business risk and remediation guidance.
• Lead executive briefings, client updates and post-incident reviews.
• Manage multiple concurrent incidents in fast-paced, high-pressure environments.
• Coordinate the work of DFIR consultants and analysts assigned to an engagement, and share expertise through informal coaching and knowledge sharing.
• Support incident readiness, tabletop exercises and client growth initiatives.

Qualifications

• 3–5 years of hands-on DFIR experience in real-world incidents.
• 6–10 years in client-facing consulting, incident response or cyber advisory roles.
• Proven experience as an incident commander or senior DFIR lead.
• Strong background in ransomware, cloud/identity compromise and complex attack investigations.
• Experience working directly with executives, legal counsel, insurers and technical teams.
• Ability to manage multiple stakeholders, workstreams and timelines under pressure.
• Strong knowledge across endpoint, cloud, identity, SaaS and network forensics.
• Experience with tools such as EnCase, FTK, Magnet AXIOM, Velociraptor, Splunk, Sentinel and CrowdStrike (or similar).
• Familiarity with Microsoft 365, Entra ID, Azure, AWS, Okta and Google Workspace.
• Understanding of attacker tradecraft, including persistence, lateral movement and data exfiltration.
• Working knowledge of KQL, SPL, SQL, PowerShell, Python or Bash.
• Exceptional communication skills, with the ability to translate technical issues into business impact.
• Strong judgment and composure in high-stress, ambiguous environments.
• A collaborative, client-focused approach with a focus on quality and outcomes.

Requirements

• Experience working with breach counsel, insurers or regulators.
• Incident readiness, tabletop or IR planning experience.
• Certifications such as CISSP, GCFA, GCIH, GCFE, GNFA, OSCP.

Education

• Bachelor's degree preferred (Cybersecurity, Computer Science, DFIR or a related field), or equivalent professional experience.

Benefits

• Take command of high-impact, global cyber investigations, guiding clients through critical, business-defining incidents.
• Work alongside experienced DFIR experts, including former government cyber professionals and industry veterans, across complex environments and advanced threat scenarios.
• Join a global, mission-driven cybersecurity company defending organizations worldwide with cutting-edge data, technology, and expertise.
• Competitive compensation and a comprehensive benefits package, with support for wellbeing, development, and career growth.