[Hiring] Principal DFIR Consultant @GuidePoint Security

Role Description

The Principal DFIR Consultant is the highest individual contributor level within GuidePoint Security's DFIR Practice. Operating at the intersection of deep technical expertise, client leadership, and organizational influence, the Principal serves as the practice's foremost technical authority. This individual is brought in on the most complex, high-severity, and high-visibility engagements. In addition to leading critical investigations, the Principal shapes how the practice operates:

• Developing methodologies
• Mentoring Senior and Analyst-level staff
• Contributing to business development
• Driving continuous improvement across the team

Qualifications

• 8+ years of hands-on DFIR experience, including complex incident response and forensic investigations
• 10+ combined years of IT and information security experience
• Demonstrated experience in a Lead or senior technical role on high-severity engagements (ransomware, APT, nation-state, or insider threat)
• Expert-level proficiency across multiple DFIR disciplines: host forensics, network forensics, log analysis, malware triage, cloud IR, and BEC investigation
• Exceptional written and verbal communication skills; ability to present complex technical findings to executive and legal audiences
• Proven track record of mentoring and developing junior and mid-level technical staff
• Experience developing or contributing to DFIR methodologies, playbooks, or tooling
• Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes

Requirements

• Serve in the Oversight role on complex or high-severity engagements, reviewing findings before client calls
• Lead on Critical Engagements, stepping in as engagement Lead on the most complex or sensitive investigations
• Conduct advanced host forensics, network analysis, malware reverse engineering/triage, cloud forensics, threat actor attribution, and intelligence-driven investigation
• Serve as a trusted surge resource for the team during high-volume periods
• Design, document, and maintain DFIR investigation methodologies, playbooks, and SOPs
• Actively mentor Senior Consultants and Analysts
• Lead internal training sessions, write technical blog posts, and document lessons learned
• Identify gaps in current tooling and processes; design and build automation
• Participate in candidate screening, technical interviews, and skills assessment
• Build deep, trusted relationships with key clients and stakeholders
• Support pre-sales activities including technical scoping, proposal development, and client presentations
• Represent GuidePoint Security externally through conference presentations and publications
• Maintain consistent availability outside standard business hours for high-severity incident surges
• Participate in on-call rotation as appropriate for seniority
• Proactively identify and address gaps in team performance, processes, or client delivery

Benefits

• Remote workforce primarily (U.S. based only, some travel may be required for certain positions)
• Group Medical Insurance options: Zero Deductible PPO Plan or High Deductible Health Plan with HSA
• Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans
• 12 corporate holidays and a Flexible Time Off (FTO) program
• Healthy mobile phone and home internet allowance
• Eligibility for retirement plan after 2 months at open enrollment
• Pet Benefit Option