Senior Cyber Defense & Offensive Security Specialist (DFIR | Red Team | CTI) - Level 5

Remote position
Job Title: Senior Cyber Defense & Offensive Security Specialist (DFIR | Red Team | CTI) Level 5

Role Overview
Threat Research Advisory team is seeking a highly skilled and versatile cybersecurity professional to lead and execute advanced Digital Forensics & Incident Response (DFIR), Offensive Security Testing, and Cyber Threat Intelligence (CTI) operations. This role requires deep technical expertise, hands-on execution capability, and the ability to operate in high-pressure incident environments while supporting proactive security initiatives.
The ideal candidate will bring a blend of forensic investigation, penetration testing, threat intelligence analysis, and automation development, with exposure to legal discovery processes and executive-level cyber risk scenarios.

Key Responsibilities 1. Digital Forensics & Incident Response (DFIR)

• Manage and execute incident response engagements for rapid response retainers, including:
  • Unauthorized access incidents
  • Malware outbreaks and advanced threats
  • Cyber extortion and ransomware attacks
• Perform:
  • Digital evidence acquisition and forensic analysis
  • Deleted data recovery and memory analysis
  • Malware reverse engineering
• Operate under legal frameworks, ensuring alignment with Attorney Work Product and legal privilege requirements

2. Offensive Security & Red Team Operations

• Conduct comprehensive penetration testing and adversary simulations, including:
  • Internal and external network testing
  • Web, cloud, mobile (iOS), and thick client assessments
  • Wireless infrastructure testing
• Execute exploitation techniques such as:
  • SQL injection, cross-site scripting (XSS)
  • Privilege escalation and credential attacks
• Lead Social Engineering campaigns:
  • Phishing, smishing, pre-texting
• Perform Physical Security Assessments:
  • Facility access testing
  • RFID cloning
  • USB payload deployment

3. Cyber Threat Intelligence (CTI) & Threat Hunting

• Monitor and analyze intelligence across:
  • Surface, deep, and dark web environments
• Identify risks such as:
  • Stolen intellectual property
  • Brand impersonation and typosquatting
  • Credential leaks and compromise indicators
• Develop and operationalize:
  • Automation workflows and GenAI-driven threat hunting tools
  • IOC enrichment pipelines and intelligence correlation models

4. CSIRT Operations, Labs & E-Discovery

• Support and operate 24/7 CSIRT functions, including:
  • Alert triage and incident containment
• Deploy and manage:
  • Network Telemetry Analysis (NTA) sensors
  • Full packet capture solutions
• Execute E-Discovery and forensic data processing, including:
  • Predictive coding models
  • Handling and hosting Electronically Stored Information (ESI)
  • Using platforms such as Relativity and Nuix

5. Incident Preparedness & Executive Protection

• Develop and maintain:
  • Incident Response Plans (IRPs)
  • Decision matrices and escalation protocols
  • Executive reporting frameworks
• Conduct:
  • Ransomware simulations and breach exercises
  • Executive tabletop scenarios
• Deliver Executive Identity Protection (EIP) services:
  • Removal of sensitive personal data from public sources and data brokers

Required Skills & Experience Technical Expertise

• Proven experience in:
  • Multi-vector penetration testing (Network, Web, Cloud, Mobile, Wireless, Physical)
  • DFIR and compromise assessments
  • Malware analysis and reverse engineering
• Strong proficiency with tools such as:
  • Wireshark, Nmap, Recorded Future (or equivalent CTI platforms)
• Experience in:
  • OSINT collection and analysis
  • Network telemetry analysis

Automation & Development

• Strong scripting and development skills in:
  • Python
  • Linux-based environments
• Experience building:
  • Security automation tools
  • Agentic workflows and bot-driven intelligence pipelines

Forensics & Legal Discovery

• Hands-on experience managing:
  • Electronically Stored Information (ESI)
  • Legal discovery workflows
• Familiarity with:
  • Relativity, Nuix, or similar platforms

Certifications
Preferred certifications include:

• Offensive Security Certified Professional (OSCP)
• Certified Ethical Hacker (CEH)
• GIAC Security Essentials (GSEC)
• Additional DFIR or CTI certifications are a plus

Soft Skills & Attributes

• Ability to operate in high-pressure incident scenarios
• Strong analytical and investigative mindset
• Excellent stakeholder communication, including interaction with legal counsel and executives
• Ability to bridge offensive, defensive, and intelligence domains
• Strong documentation and reporting skills