Cyber Defense DFIR Manager

The Cyber Defense DFIR Manager reports to the Director of Cyber Defense and operates within the Office of the CISO. This role owns incident response and digital forensics as a dedicated discipline within the cyber defense function, maintaining and continuously improving the incident response program and entity-specific incident response playbooks across NorthMark Strategies' diverse ecosystem of operating companies spanning quantitative research, banking, motorsport, and advanced technology ventures. The role is also an incident command resource for significant incidents, partnering closely across cyber defense to ensure a seamless path from detection through investigation, containment, and recovery.

Responsibilities

Maintain and continuously update the enterprise incident response plan and entity-specific incident response playbooks across the Ecosystem; Operationalize and mature the DFIR function, strengthening tooling, workflows, evidence-handling standards, and operational metrics; Lead forensic investigations across host, network, cloud, mobile, and memory evidence in support of security incidents, insider risk cases, and legal/HR matters; Establish and enforce chain-of-custody and evidence-handling practices; Lead forensic investigations within the Microsoft ecosystem, including Unified Audit Log analysis, Microsoft Purview eDiscovery and Content Search, and Graph API-based evidence collection; Produce defensible forensic findings and reports suitable for legal, regulatory, and litigation use, including declarations or expert-witness support; Build and maintain the forensic lab and evidence-handling infrastructure, including write-blockers, forensic workstations, secure evidence storage, and hashing/validation procedures; Mature legal hold and eDiscovery processes across all entities in partnership with Legal; Serve as incident commander or deputy on significant incidents, coordinating cross-functional response and leading post-incident reviews, root cause analysis, and corrective action tracking; Design, organize, and run table top exercises and simulations across the Ecosystem, owning the exercise calendar and after-action reporting; Maintain consistent incident response readiness across the multi-tenant Ecosystem, adapting plans to entity-specific regulatory and reporting obligations; Work with SIEM/detection engineering and other cyber defense functions to ensure seamless handoff from detection to investigation and response; Evaluate and adopt AI and automation to accelerate triage, evidence correlation, and timeline reconstruction; Incorporate IOCs, TTPs, and adversary tradecraft into incident response playbooks and forensic methodology; Report on incident response posture, exercise outcomes, and DFIR metrics to the Director of Cyber Defense and other stakeholders; Build, manage, and develop a team of incident response and forensics professionals, including hiring, performance development, workload and on-call rostering, and casework quality

Requirements

Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent experience; 7+ years of progressive experience in incident response, digital forensics, or security operations, including maintaining incident response plans or playbooks; 3+ years of experience directly managing or mentoring incident response/forensics professionals, including performance development, workload prioritization, and on-call rostering; Hands-on digital forensics experience across disk, memory, network, and cloud evidence, including timeline reconstruction and malware/triage analysis; Experience with mobile device forensics (iOS/Android acquisition and analysis); Experience with cloud-native forensics across AWS, Azure, and containerized/Kubernetes environments; Experience with Microsoft 365/Entra-native forensic investigation, including Purview eDiscovery/Content Search, Unified Audit Log analysis, and Graph API-based evidence collection; Experience producing forensic reports and documentation suitable for legal or regulatory proceedings, including litigation support or expert-witness readiness; Experience building or maintaining forensic lab infrastructure, including write-blockers, forensic workstations, and secure evidence storage and chain-of-custody systems; Demonstrated experience designing, organizing, and running table top exercises or incident response simulations; Experience operationalizing or maturing an incident response or DFIR function within an existing program; Experience building or maturing legal hold and eDiscovery processes, including preservation notices, custodian tracking, and defensible collection, ideally across a multi-entity environment; Working knowledge of the Microsoft security ecosystem (Sentinel, Defender suite, Entra ID) and proficiency with KQL, Python, or PowerShell; Experience with forensic and IR tooling such as Magnet AXIOM, Magnet Nexus, X-Ways Forensics, and Magnet Verakey, and with EDR-integrated forensic workflows; Strong command of incident response and forensic frameworks, including NIST SP 800-61 and MITRE ATT&CK, and experience operationalizing threat intelligence into response work; Exceptional written and verbal communication skills, with the ability to lead calmly under pressure during live incidents; High level of personal integrity and the ability to handle confidential and sensitive matters; Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future

Nice to have

Experience operating in multi-tenant, multi-entity, or MSSP-like environments; Possession of, or ability to obtain, certifications such as GCFE, GCFA, GNFA, GREM, EnCE, CHFI, or CISSP

Benefits

Company-paid lunch stipend via GrubHub; 100% employer-paid medical in High-Deductible Health Plan; Dental and Vision benefits for employees and families; 16 weeks of Paid Parental Leave; Employee Assistance Program; Life insurance; Short-Term Disability and Long-Term Disability; 401(k) with 100% company match up to 6%; Optional employee-paid PPO medical insurance; Health Savings Accounts with company contribution; Flexible Spending Accounts; Supplemental Life Insurance; Wellhub; 25 days of Paid Time Off plus 12 company holidays