PLAID ELITE DFIR Consultant (AI Security)

Location: Boston, MA, United States; hybrid workplace with remote listed as another location

Company

hirify.global is an early-stage AI security company building a federated SIEM and AI agents for detection, investigation, response, and threat hunting.

What you will do

• Run scoping calls with clients, breach counsel, and cyber insurance carriers, then manage emergency IR engagements from planning through final delivery.
• Lead and personally perform enterprise investigations across host, network, cloud, SaaS, and application evidence, including ransomware, business email compromise, data theft, and intrusion matters.
• Collect and analyze evidence through the hirify.global platform and Velociraptor; write and maintain VQL artifacts and develop investigative tooling.
• Validate AI-driven forensic findings against source evidence, identify errors and uncertainty, and retain expert human judgment in client conclusions.
• Act as an escalation point and mentor for PLAID ELITE analysts, including on forensic collection, malware analysis, and root-cause determination.
• Own client and counsel updates, briefings, and final reports; maintain defensible evidence handling and participate in the on-call rotation.

Requirements

• 8+ years of digital forensics and incident response experience, including leading client-facing engagements at a consultancy or IR firm.
• Proven experience leading emergency IR engagements directed by breach counsel and cyber insurance carriers, from scoping through findings delivery.
• Deep enterprise forensics expertise across Windows, macOS, Linux, network, AWS, Azure, GCP, Microsoft 365, Google Workspace, and application evidence, including memory analysis and large-scale log correlation.
• Hands-on Velociraptor experience, including writing VQL artifacts, plus scripting in Python, PowerShell, or similar.
• Working knowledge of malware analysis and experience querying SIEM and EDR data with KQL, SPL, FQL, or SQL.
• Sound judgment when evaluating automated or AI-generated analysis, including testing results and returning to raw evidence when necessary.
• Excellent written and verbal communication for executives, counsel, and engineers.
• Calm, decisive crisis leadership across scoping calls, ransomware investigations, counsel briefings, and on-call response.

Nice to have

• GIAC certifications such as GCFA, GCFE, GNFA, GREM, or GCIH, and/or CISSP.
• Prior experience in a managed detection and response environment.

Culture & Benefits

• Full-time role within the DFIR team in Professional Services, reporting to the Head of DFIR.
• Hybrid workplace with Boston, United States listed as the role location and remote listed as another location.
• Participation in an on-call rotation supporting emergency response.
• Collaboration with Engineering and Product to shape the hirify.global platform and AiDFIR roadmap.