Senior Incident Examiner/Negotiator, DFIR (Cybersecurity)

Location: Remote within the United States. Candidates must be legally authorized to work in the United States. The role requires team on-call availability, including time-sensitive communications outside normal business hours and across time zones.

Salary: USD 130,000–195,000 annually

Company

hirify.global is a managed security services provider delivering strategic advisory, managed security, offensive security, threat intelligence, and incident response services.

What you will do

• Lead and coordinate cybersecurity incident responses across identification, containment, eradication, recovery, digital forensics, log analysis, and reporting.
• Conduct forensic investigations across servers, endpoints, networks, SaaS platforms, cloud environments, and identity systems; collect and preserve evidence in accordance with legal and regulatory requirements.
• Communicate directly with ransomware and extortion threat actors, establish secure communication channels, preserve detailed records, and execute negotiation strategies with authorized stakeholders.
• Assess threat actor identity, credibility, behavior, proof-of-compromise and exfiltration claims, demands, deadlines, and settlement or decryption conditions.
• Coordinate negotiation intelligence with forensic analysis, scoping, containment, threat intelligence, recovery, and client decision-making.
• Prepare incident narratives and briefings for client leadership, counsel, insurers, DFIR teams, IT, legal, compliance, and external vendors.

Requirements

• Strong knowledge of digital forensics tools and techniques, including X-Ways or similar forensic tooling.
• Experience with incident response frameworks and methodologies such as NIST and SANS.
• Experience conducting or materially supporting threat actor communications, ransomware negotiations, cyber extortion negotiations, crisis negotiations, or comparable high-stakes adversarial communications.
• Understanding of ransomware and data-extortion ecosystems, threat actor communication methods, leak sites, negotiation portals, cryptocurrency-related settlement workflows, and ransomware response operations.
• Experience using threat intelligence and prior threat actor behavior to support attribution, credibility analysis, negotiation planning, and client risk decisions.
• Strong understanding of network protocols, operating systems, and security technologies, with excellent analytical and problem-solving skills.
• Ability to communicate calmly under pressure and distinguish investigative facts, threat actor claims, assumptions, and negotiation positions.
• Ability to work independently, manage multiple projects, maintain detailed documentation, and write clear incident reports for non-technical audiences.
• Strong written and verbal communication skills.

Nice to have

• Bachelor's or master's degree in digital forensics, computer science, or a closely related field.
• DFIR certification.
• Python or PowerShell scripting knowledge for automation and analysis.
• Knowledge of database formats for investigative and knowledge purposes.
• Law enforcement, crisis negotiation, behavioral analysis, threat intelligence, HUMINT, or adversarial communications experience.
• Experience coordinating ransomware or extortion matters with breach counsel, cyber insurers, law enforcement, payment or settlement providers, and executive stakeholders.

Culture & Benefits

• Flexible work with in-person collaboration for key moments based on role, team, and business needs.
• Medical, dental, and vision insurance.
• 401(k) with employer matching, paid time off, holidays, flexible spending accounts, and health savings accounts.
• Employee assistance, adoption assistance, and training and development programs.
• Participation in team on-call scheduling is required.