[Hiring] Principal DFIR Consultant @MOXFIVE

Role Description

We're looking to expand our IR Consulting Team with individuals driven to protect clients, eliminate threat actors, and build the next era of digital forensics and incident response for the modern enterprise, including the LLM-based investigative platform we're building to get them there.

Qualifications

• Experience responding to threat activity as an IR consultant or SOC analyst
• Strong understanding of Windows/Mac/Linux fundamentals, forensic artifacts, and network analysis
• Existing knowledge or passion to learn cloud-native investigations across AWS, GCP, and Azure, including familiarity with core log sources like CloudTrail, VPC Flow Logs, GCP Admin Activity/Data Access logs, and Entra ID/M365 audit logs
• Curiosity about how LLMs and AI-assisted tooling can accelerate investigation and reporting without compromising forensic rigor, and interest in helping shape an internal LLM-based investigative platform built to accelerate future casework
• An unwavering emphasis on investigation at the highest level of quality

Requirements

• Windows environment investigations feel like the back of your hand
• Experience with cloud-native forensics, including investigating account takeovers across Azure, GCP, AWS, and SaaS Apps
• Knowledge of CloudTrail and GuardDuty findings in AWS, Admin Activity and Data Access logs in GCP, and sign-in and audit logs in Entra ID
• Comfortable chasing rogue service principals or suspicious Workload Identity Federation grants
• Ability to use LLMs and AI tooling as part of the investigative process
• Experience in rapidly triaging thousands of authentication logs for anomalous patterns
• Ability to build timeline narratives faster without sacrificing accuracy
• Experience in using AI-assisted tooling to spot anomalies in cloud audit logs
• Desire to contribute to building LLM-based investigative platforms

Benefits

• Join a seasoned team of high-performing incident response consultants
• Support and lead meaningful cases across traditional enterprise and cloud-native environments
• Shape technology stack, investigative methodology, and service offerings
• Influence the responsible building of LLM-driven capabilities into the investigative workflow