[Hiring] Senior Incident Examiner/Negotiator @LevelBlue LLC

Role Description

We are seeking a highly skilled and motivated Digital Forensics and Incident Response (DFIR) practitioner to join our Global LevelBlue DFIR team. The ideal candidate will be responsible for:

• Investigating and responding to cybersecurity incidents.
• Conducting digital forensic and incident response investigations.
• Working independently against engagement milestones from forensics to log analysis to report writing.
• Conducting Threat Actor communications and data encryption (ransomware)/extortion negotiations when required.

This role requires deep technical expertise, strong analytical and communication skills, sound judgment, and the ability to operate effectively under pressure in fast-moving and high-stakes incidents. This role requires being available during team on-call scheduling.

Key Responsibilities

• Digital Forensics & Incident Response:
  • Lead and coordinate responses to cybersecurity incidents, including identification, containment, eradication, and recovery.
  • Analyze and investigate security breaches to determine the root cause and impact.
  • Conduct digital forensic science-based incident response investigations on various digital devices.
  • Collect, preserve, and analyze digital evidence in accordance with legal and regulatory requirements.
  • Support time-sensitive communications during active ransomware or extortion incidents.
• Threat Actor Communications & Negotiation:
  • Conduct direct communications with ransomware and extortion Threat Actors on behalf of clients.
  • Develop and execute communication and negotiation strategies based on various factors.
  • Establish and maintain secure communication channels with Threat Actors.
  • Assess Threat Actor identity, credibility, behavior, and other intelligence to inform negotiation strategy.
  • Manage the cadence, tone, sequencing, and content of communications.
  • Support ransomware and extortion negotiations.
  • Provide clear, timely briefings to client leadership and stakeholders.
  • Coordinate TA communications with the broader DFIR investigation.
  • Maintain strict confidentiality and professional ethics.
• Cloud Digital Forensics:
  • Training and experience in conducting analysis within cloud environments.
  • Analyze Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) specific to cloud intrusions.
  • Identify misuse of APIs, service principals, roles, and OAuth applications.
• Identity and Access Investigations:
  • Investigate compromise involving IAM roles and identities.
  • Analyze authentication patterns and assess privilege escalation paths.
• Reporting and Documentation:
  • Prepare detailed incident reports that articulate a story of the incident.
  • Maintain accurate and thorough documentation of all incident response activities.
• Collaboration and Communication:
  • Work closely with cross-functional teams and Client teams.
  • Communicate effectively with stakeholders to provide updates.

Qualifications

• Strong knowledge of digital forensics tools and techniques.
• Experience with incident response frameworks and methodologies.
• Excellent analytical and problem-solving skills.
• Strong understanding of network protocols, operating systems, and security technologies.
• Excellent written and verbal communication skills.
• Ability to work independently and manage multiple projects simultaneously.
• Demonstrated experience in Threat Actor communications and negotiations.
• Ability to communicate calmly in high-pressure situations.
• Understanding of ransomware and data-extortion ecosystems.
• Experience using threat intelligence for negotiation planning.
• Strong written documentation skills.

Preferred Qualifications

• Bachelor's or Master's degree in Digital Forensics, Computer Science, or closely related field.
• Certification(s) in DFIR.
• Knowledge of scripting languages for automation and analysis.
• Prior experience in law enforcement and/or crisis negotiation.
• Formal training in crisis negotiation or adversarial communications.
• Experience coordinating ransomware or extortion matters.

Benefits

• Comprehensive medical, dental, and vision insurance.
• 401(k) with employer matching.
• Generous paid time off and holidays.
• Flexible spending accounts and health savings accounts.
• Employee assistance programs.
• Training and development opportunities.
• Adoption assistance program.