Lead and mentor the incident response consulting team; manage engagements and metrics; perform incident investigations, forensics, triage, containment, and QA; collaborate with product and sales to evolve services and build automation and playbooks; liaise with law enforcement and stakeholders to ensure timely resolution and lessons-learned.

Provide technical incident response support across the IR lifecycle: triage, forensic analysis, containment, eradication, and remediation. Conduct host/network forensics and malware analysis, investigate ransomware and BEC incidents (Microsoft 365/Exchange/Azure/Google Workspace), create client reports, support after-hours response, and improve detection capabilities with the SOC.

Lead and conduct forensic host, network, and application investigations; triage high-stakes incidents; develop scripts and tooling; produce technical and executive reports; guide containment, remediation, rebuild, and recovery; work directly with client IT teams and participate in on-call incident response.