Lead and perform DFIR investigations across hosts, networks, and applications; triage high‑stakes incidents; develop scripts/tools; produce technical and executive reports; guide containment, remediation, rebuilds, and EDR/system recoveries while working directly with client IT teams.