Palo Alto Networks
Principal Consultant, DFIR, Reactive Services (Unit 42) - Remote Weekend Shift
$151K–$208K
Burbank, United States of America · Yes · Principal · Full-time · Posted Oct 1, 2026
- Experience
- 6–8+ years in DFIR, incident response, security operations, or related cybersecurity disciplines.
- Education
- Bachelor's degree or equivalent practical experience.
- Visa sponsorship
- No work visa sponsorship.
About the job
Leads digital forensics and incident response investigations, guiding clients through incident analysis, containment, remediation, and recovery.
What you'll do
- Lead enterprise DFIR investigations and serve as technical lead on response engagements.
- Investigate host, network, and cloud environments to determine attacker activity, root cause, and scope of compromise.
- Analyze forensic evidence, deliver findings and remediation guidance, and support playbooks and team knowledge-sharing.
What they ask for
- Bachelor's degree or equivalent practical experience.
- 6–8+ years of experience in DFIR, incident response, security operations, or related cybersecurity disciplines.
- Experience investigating ransomware, intrusion activity, and other enterprise-scale security incidents.
- Hands-on experience with DFIR tools such as EnCase, FTK, SleuthKit, Volatility, or equivalent frameworks.
Nice to have
- Knowledge of MITRE ATT&CK and modern adversary tradecraft; experience with malware triage or reverse engineering.
- Certifications such as GCFA, GCFE, GCIH, CISSP, or similar.
Pay
$151,000.00 - $208,000.00/yr (base salary)
Tools
EnCase, FTK, SleuthKit, Volatility, MITRE ATT&CK
Model-written summary · the original posting is authoritative