Serve as incident commander during high-severity events, particularly ransomware and enterprise-scale breaches
Oversee multiple concurrent engagements, ensuring quality, consistency, and appropriate resource allocation
Define investigative strategy and escalation thresholds for complex incidents
Align technical response with legal, regulatory, insurance, and executive considerations
Review and approve investigative findings, containment validation, and executive reporting
Act as senior advisor to client executives, legal counsel, and cyber insurers
Provide guidance to Supervisors on advanced investigative decisions and complex threat actor scenarios
Maintain executive-level communication cadence during incidents
Support development of standardized methodologies, playbooks, and quality controls across the practice
Mentor Supervisors and Consultants in both technical depth and client leadership
Participate in on-call rotation and provide oversight during critical incidents

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or equivalent experience
Proven experience leading enterprise-scale ransomware and breach investigations
Deep understanding of threat actor operations and ransomware tradecraft
Strong hands-on familiarity with EDR platforms, SIEM technologies, and forensic toolsets
Demonstrated ability to manage multiple high-pressure engagements simultaneously
Experience coordinating with legal counsel, cyber insurance carriers, and executive leadership
Strong executive presence and crisis communication ability
Experience mentoring and developing DFIR leaders
Certifications such as GCFA, GCIH, CISSP, OSCP, or equivalent preferred

Digital Forensics & Incident Response Manager

Key skills