Palo Alto Networks
Principal Consultant, DFIR, Reactive Services (Unit 42) - Remote
$158K–$217K
Burbank, United States of America · Yes · Principal · Full-time · Posted Oct 1, 2026
- Experience
- 6–8 years of hands-on experience in DFIR, security operations, or related cybersecurity disciplines.
- Education
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
- Visa sponsorship
- Will not sponsor applicants for work visas for this position.
About the job
Leads client-facing digital forensics and incident response investigations, including advanced analysis, incident guidance, and recovery recommendations.
What you'll do
- Lead incident response engagements and forensic investigations across enterprise environments.
- Analyze host, network, cloud, and endpoint evidence to determine root cause, attacker behavior, and compromise scope.
- Provide clients with technical findings and remediation guidance; contribute to playbooks and team knowledge sharing.
What they ask for
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
- 6–8 years of hands-on experience in DFIR, security operations, or related cybersecurity disciplines.
- Experience investigating enterprise-scale incidents and strong knowledge of forensic methods, evidence handling, acquisition, and chain of custody.
- Hands-on experience with DFIR tools such as EnCase, FTK, SleuthKit, or Volatility, and investigations across Microsoft Windows, Linux, and macOS.
Nice to have
- Cloud and hybrid incident response experience; knowledge of MITRE ATT&CK.
- Malware triage or reverse engineering experience; relevant certifications such as GCFA, GCFE, GCIH, or CISSP.
Pay
$157,600.00 - $216,700.00/yr (base salary)
Tools
EnCase, FTK, SleuthKit, Volatility, Microsoft Windows, Linux, macOS, MITRE ATT&CK
Model-written summary · the original posting is authoritative