Incident Commander, Digital Forensics & Incident Response

Position: Incident Commander ​​​
Reports To: Head of Digital Forensics & Incident Response
Department: Digital Forensics & Incident Response
Location: Remote, US
Work Authorization: US Citizenship Required

BlueVoyant is seeking an Incident Commander, Digital Forensics & Incident Response to lead high-impact cyber investigations and take command of complex, high-pressure security incidents. This is a senior, client-facing individual contributor role with no direct reports. You'll guide organizations through critical moments, from initial response through investigation, containment and recovery, while advising executives, legal counsel and technical teams.
What You'll Do:

• Act as incident commander for complex DFIR engagements end-to-end.
• Serve as the primary client lead, advising executives, legal counsel, insurers and stakeholders.
• Lead investigations across ransomware, BEC, cloud/identity compromise, insider threat and advanced attacks.
• Perform and direct forensic analysis across endpoints, cloud, identity, SaaS, email and network environments.
• Translate technical findings into clear business risk and remediation guidance.
• Lead executive briefings, client updates and post-incident reviews.
• Manage multiple concurrent incidents in fast-paced, high-pressure environments.
• Coordinate the work of DFIR consultants and analysts assigned to an engagement, and share expertise through informal coaching and knowledge sharing.
• Support incident readiness, tabletop exercises and client growth initiatives.

• 3–5 years of hands-on DFIR experience in real-world incidents.
• 6–10 years in client-facing consulting, incident response or cyber advisory roles.
• Proven experience as an incident commander or senior DFIR lead.
• Strong background in ransomware, cloud/identity compromise and complex attack investigations.
• Experience working directly with executives, legal counsel, insurers and technical teams.
• Ability to manage multiple stakeholders, workstreams and timelines under pressure.
• Strong knowledge across endpoint, cloud, identity, SaaS and network forensics.
• Experience with tools such as EnCase, FTK, Magnet AXIOM, Velociraptor, Splunk, Sentinel and CrowdStrike (or similar).
• Familiarity with Microsoft 365, Entra ID, Azure, AWS, Okta and Google Workspace.
• Understanding of attacker tradecraft, including persistence, lateral movement and data exfiltration.
• Working knowledge of KQL, SPL, SQL, PowerShell, Python or Bash.
• Exceptional communication skills, with the ability to translate technical issues into business impact.
• Strong judgment and composure in high-stress, ambiguous environments.
• A collaborative, client-focused approach with a focus on quality and outcomes.

• Experience working with breach counsel, insurers or regulators.
• Incident readiness, tabletop or IR planning experience.
• Certifications such as CISSP, GCFA, GCIH, GCFE, GNFA, OSCP.

• Bachelor's degree preferred (Cybersecurity, Computer Science, DFIR or a related field), or equivalent professional experience.

• Take command of high-impact, global cyber investigations, guiding clients through critical, business-defining incidents.
• Work alongside experienced DFIR experts, including former government cyber professionals and industry veterans, across complex environments and advanced threat scenarios.
• Join a global, mission-driven cybersecurity company defending organizations worldwide with cutting-edge data, technology, and expertise.
• Competitive compensation and a comprehensive benefits package, with support for wellbeing, development, and career growth.