Role: Senior Director, Digital Forensics & Incident ResponseLocation: Remote, USWork Authorization: US Citizenship RequiredBlueVoyant is seeking a Senior Director, DFIR to lead high-impact cyber investigations and act as incident commander during complex, high-pressure security incidents.This is a client-facing leadership role responsible for guiding organizations through critical moments—from initial response through investigation, containment, and recovery—while advising executives, legal counsel, and technical teams.What You’ll Do:Act as incident commander for complex DFIR engagements end-to-endServe as the primary client lead, advising executives, legal counsel, insurers, and stakeholdersLead investigations across ransomware, BEC, cloud/identity compromise, insider threat, and advanced attacksDirect forensic analysis across endpoints, cloud, identity, SaaS, email, and network environmentsTranslate technical findings into clear business risk and remediation guidanceLead executive briefings, client updates, and post-incident reviewsManage multiple concurrent incidents in fast-paced, high-pressure environmentsMentor and develop DFIR consultants and technical teamsSupport incident readiness, tabletop exercises, and client growth initiativesWhat You Bring:3–5 years of hands-on DFIR experience in real-world incidents6–10 years in client-facing consulting, incident response, or cyber advisory rolesProven experience as an incident commander or senior DFIR leadStrong background in ransomware, cloud/identity compromise, and complex attack investigationsExperience working directly with executives, legal counsel, insurers, and technical teamsAbility to manage multiple stakeholders, workstreams, and timelines under pressureLeadership experience mentoring or managing technical teamsTechnical Expertise:Strong knowledge across endpoint, cloud, identity, SaaS, and network forensicsExperience with tools such as EnCase, FTK, Magnet AXIOM, Velociraptor, Splunk, Sentinel, CrowdStrike (or similar)Familiarity with Microsoft 365, Entra ID, Azure, AWS, Okta, Google WorkspaceUnderstanding of attacker tradecraft, including persistence, lateral movement, and data exfiltrationWorking knowledge of KQL, SPL, SQL, PowerShell, Python, or BashLeadership & Communication:Exceptional communication skills—able to translate technical issues into business impactStrong judgment in high-stress, ambiguous environmentsComposed, credible, and client-focused under pressureCollaborative leader with a focus on quality, mentorship, and outcomesNice to Have:Experience working with breach counsel, insurers, or regulatorsIncident readiness, tabletop, or IR planning experienceCertifications such as CISSP, GCFA, GCIH, GCFE, GNFA, OSCPEducation:Bachelor’s degree preferred (Cybersecurity, Computer Science, DFIR, or related), or equivalent professional experience.Why BlueVoyant?Work alongside experienced DFIR leaders and experts, including former government cyber professionals and industry veterans.Lead high-impact, global cyber investigations, supporting clients through critical, business-defining incidentsGain exposure to complex environments, executive stakeholders, and advanced threat scenarios across industriesJoin a global, mission-driven cybersecurity company defending organisations worldwide with cutting-edge data, technology, and expertiseCompetitive compensation and comprehensive benefits package, with support for wellbeing, development, and career growthAbout BlueVoyantBlueVoyant is an AI-driven cybersecurity company dedicated to standing between our customers and cyber threats. By combining human, artificial, and proprietary intelligence, we deliver a unified solution that protects every organization’s network, identities, vendors, and digital footprints as a single attack surface. The company’s award-winning Microsoft Security expertise helps organizations maximize their security investments while reducing risk and ensuring compliance. Led by CEO, John Hernandez, BlueVoyant’s highly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency, Federal Bureau of Investigation, Unit 8200, and GCHQ, together with private sector experts. BlueVoyant services utilize large real-time datasets with industry leading analytics and technologies. Founded in 2017 by Fortune 500 executives, including Chairman of the Board, Jim Rosenthal, Vice Chairman, Tom Glocer, and former Government cyber officials, BlueVoyant is headquartered in New York City and has offices in Maryland, Tel Aviv, San Francisco, London, Budapest, and Latin America and is committed to building a workplace where talented people are empowered to do their best work in the fight against global cyber threats.. Important Information for Applicants BlueVoyant uses AI-assisted tools within our applicant tracking system to help identify candidates whose experience and skills best match the requirements of a role. This technology provides hiring teams with added insights to support fair and efficient hiring decisions. All applications are reviewed by a member of our hiring team, and final hiring decisions are made by humans, not AI. By submitting your application, you acknowledge that AI tools may assist in the evaluation of your resume as part of the recruitment process.While we embrace the use of AI within our business and recruitment process, we do not permit its use during interviews. Any suspected use of AI during an interview will be challenged, and this may include the use of detection tools.For more information on how we process your personal data, please review our Candidate Privacy Notice available at
https://www.bluevoyant.com/candidate-privacy-notice. All employees must be authorized to work in the United States of America. BlueVoyant provides equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability, or genetics.Disclaimer: Please note that pursuant to contractual requirements and applicable law, for employees to perform work on some of the company’s federal contracts, U.S. citizenship is required. Accordingly, an employee’s ability to perform work on such contracts is contingent upon the company’s verification of the employee’s citizenship status.Interview ExpectationsAs part of our interview process, we assess your experience through real-time discussion, so we expect responses to be your own. While we support the use of AI in our business, it is not permitted during interviews, and any suspected use may be challenged, including through detection methods.BlueVoyant Candidate Privacy NoticeTo understand how we secure and manage your personal data upon submitting a job application, please see our Candidate Privacy Notice, which can be found here -
Candidate Privacy Notice
