Principal Consultant, DFIR

• Digital Forensics & Incident Response: Be able to lead and coordinate responses to cybersecurity incidents, including identification, containment, eradication, and recovery. Analyze and investigate security breaches to determine the root cause and impact. Conduct digital forensic science-based incident response investigations on a variety of digital devices, including servers and end user workstations, network systems, SaaS platforms that contain artifacts, logging, and data of investigative relevance. Collect, preserve, and analyze digital evidence in accordance with legal and regulatory requirements.
• Be able to lead and coordinate responses to cybersecurity incidents, including identification, containment, eradication, and recovery.
• Analyze and investigate security breaches to determine the root cause and impact.
• Conduct digital forensic science-based incident response investigations on a variety of digital devices, including servers and end user workstations, network systems, SaaS platforms that contain artifacts, logging, and data of investigative relevance.
• Collect, preserve, and analyze digital evidence in accordance with legal and regulatory requirements.
• Threat Actor Communications & Negotiation: Conduct direct, controlled communications with ransomware and extortion Threat Actors on behalf of clients, in coordination with engagement leadership, breach counsel, insurers, and other authorized stakeholders. Develop and execute communication and negotiation strategies based on the client’s business objectives, operational impact, legal guidance, incident facts, Threat Actor behavior, and available threat intelligence. Establish and maintain secure communication channels with Threat Actors while preserving complete and accurate records of communications, demands, representations, deadlines, and negotiation activity.
• Conduct direct, controlled communications with ransomware and extortion Threat Actors on behalf of clients, in coordination with engagement leadership, breach counsel, insurers, and other authorized stakeholders.
• Develop and execute communication and negotiation strategies based on the client’s business objectives, operational impact, legal guidance, incident facts, Threat Actor behavior, and available threat intelligence.
• Establish and maintain secure communication channels with Threat Actors while preserving complete and accurate records of communications, demands, representations, deadlines, and negotiation activity.
• Assess Threat Actor identity, credibility, behavior, historical patterns, proof-of-compromise or proof-of-exfiltration claims, and other available intelligence to inform negotiation strategy and client decision-making. Manage the cadence, tone, sequencing, and content of communications to obtain information, validate claims, preserve options, manage time, and reduce unnecessary disclosure of client information or negotiating position. Support ransomware and extortion negotiations, including demand assessment, counteroffer strategy, time extensions, proof requests, data deletion or non-publication representations, decryptor validation coordination, and settlement-related communications when authorized. Provide clear, timely briefings to client leadership, counsel, insurers, and the DFIR engagement team regarding Threat Actor communications, negotiation posture, risks, decision points, and recommended next actions. Coordinate TA communications with the broader DFIR investigation so that information learned through negotiations can inform forensic analysis, scoping, containment, threat intelligence, and recovery activities, and technical findings can inform the negotiation strategy. Maintain strict confidentiality, professional ethics, independence, and need-to-know handling of client financial information, insurance information, negotiation authority, legal strategy, and other sensitive information that could affect the client’s negotiating position. Remain available to support time-sensitive communications during active ransomware or extortion incidents, including incidents requiring coordination across time zones and outside normal business hours.
• Manage the cadence, tone, sequencing, and content of communications to obtain information, validate claims, preserve options, manage time, and reduce unnecessary disclosure of client information or negotiating position.
• Support ransomware and extortion negotiations, including demand assessment, counteroffer strategy, time extensions, proof requests, data deletion or non-publication representations, decryptor validation coordination, and settlement-related communications when authorized.
• Provide clear, timely briefings to client leadership, counsel, insurers, and the DFIR engagement team regarding Threat Actor communications, negotiation posture, risks, decision points, and recommended next actions.
• Coordinate TA communications with the broader DFIR investigation so that information learned through negotiations can inform forensic analysis, scoping, containment, threat intelligence, and recovery activities, and technical findings can inform the negotiation strategy.
• Maintain strict confidentiality, professional ethics, independence, and need-to-know handling of client financial information, insurance information, negotiation authority, legal strategy, and other sensitive information that could affect the client’s negotiating position.
• Remain available to support time-sensitive communications during active ransomware or extortion incidents, including incidents requiring coordination across time zones and outside normal business hours.
• Reporting and Documentation: Be able to prepare detailed incident reports, including findings and properly authoring a story that does not just restate factual dates/times, but articulates a story of the incident for a non-technical audience. Maintain accurate and thorough documentation of all incident response activities and forensic investigations.
• Be able to prepare detailed incident reports, including findings and properly authoring a story that does not just restate factual dates/times, but articulates a story of the incident for a non-technical audience.
• Maintain accurate and thorough documentation of all incident response activities and forensic investigations.
• Collaboration and Communication: Internally, work closely with cross-functional teams inclusive of DFIR, Advisory, Testing, Threat Intelligence, MDR/MSS, etc. LevelBlue services. Externally, work closely with Client teams including IT, legal, compliance, and external vendors, to support expert delivery during engagements. Communicate effectively with stakeholders to provide updates and ensure alignment with incident response processes.
• Internally, work closely with cross-functional teams inclusive of DFIR, Advisory, Testing, Threat Intelligence, MDR/MSS, etc. LevelBlue services.
• Externally, work closely with Client teams including IT, legal, compliance, and external vendors, to support expert delivery during engagements.
• Communicate effectively with stakeholders to provide updates and ensure alignment with incident response processes.

• Proven experience in DFIR
• Strong knowledge of digital forensics tools and techniques, including X-Ways, or similar forensic tooling.
• Experience with incident response frameworks and methodologies, such as NIST, SANS, or similar.
• Excellent analytical and problem-solving skills.
• Strong understanding of network protocols, operating systems, and security technologies.
• Excellent written and verbal communication skills.
• Ability to work independently and manage multiple projects simultaneously.
• Demonstrated experience conducting or materially supporting Threat Actor communications, ransomware negotiations, cyber extortion negotiations, crisis negotiations, or comparable high-stakes adversarial communications.
• Ability to communicate calmly and deliberately in high-pressure situations and to distinguish investigative facts, Threat Actor claims, assumptions, and negotiation positions.
• Understanding of ransomware and data-extortion ecosystems, common Threat Actor communication methods, leak sites, negotiation portals, cryptocurrency-related settlement workflows, and the operational considerations associated with ransomware response.
• Experience using threat intelligence and prior Threat Actor behavior to support attribution assessment, credibility analysis, negotiation planning, and client risk decisions.
• Strong written documentation skills for maintaining contemporaneous communication logs, negotiation summaries, decision records, and stakeholder updates.

• Bachelor's or Masters degree in Digital Forensics, Computer Science-focused or closely related field of study and expertise.
• Certification(s) in DFIR
• Knowledge of scripting languages (e.g., Python, PowerShell) for automation and analysis.
• Knowledge of database formats for investigative and knowledge purposes
• Knowledge of Azure, AWS, Oracle, and/or GWP as many modern threats traverse enterprise cloud platforms and knowledge of these platforms is a necessity for modern incident response engagements
• Prior law enforcement, intelligence, military, crisis negotiation, investigative, or similar public-sector experience is a consideration and may be beneficial for candidates with otherwise strong DFIR qualifications.
• Formal training or demonstrated experience in crisis negotiation, ransomware negotiation, behavioral analysis, threat intelligence, HUMINT, or adversarial communications.
• Experience coordinating ransomware or extortion matters with breach counsel, cyber insurers, law enforcement, payment/settlement providers, and executive stakeholders.

LevelBlue?

At LevelBlue, you’re not just an employee—you’re part of a team making a real difference in the world of cybersecurity.

We foster a culture of innovation and creativity where your contributions are valued, and you’ll have the support and resources to grow and thrive.

• Comprehensive medical, dental, and vision insurance.
• 401(k) with employer matching.
• Generous paid time off and holidays.
• Flexible spending accounts and health savings accounts.
• Employee assistance programs.
• Training and development opportunities.
• Adoption assistance program.

This role is open to candidates legally authorized to work in the United States.

At LevelBlue, we support flexible work and bring people together in person for key moments based on role, team, and business needs.

LevelBlue is committed to a culture of respect, inclusion, and equal opportunity.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age, or any other status protected under applicable law.

To all agencies: Please do not contact LevelBlue employees outside of the Talent Acquisition team.

LevelBlue’s policy is to only accept resumes from agencies through its approved agency process and with a valid agreement in place.

Any resume submitted outside this process will be considered the property of LevelBlue, and no fee will be paid if a candidate is hired from such a submission.

#LI-SD1