Incident Response Consultant

About the Role We’re looking for an Incident Response Consultant to join our team and help clients navigate cybersecurity incidents with confidence. In this role, you’ll serve as a trusted technical advisor during active security incidents, working to contain threats, eradicate malicious activity, and guide clients through every stage of the incident response lifecycle. You’ll leverage our security tools and technology stack to investigate intrusions, identify indicators of compromise, and strengthen detection capabilities across network, log, and endpoint environments. The ideal candidate has strong technical expertise in incident response, thrives in high-pressure situations, communicates effectively with both technical and non-technical stakeholders, and is comfortable leading investigations while providing off-hours support when needed. Responsibilities Support the IR lifecycle from triage to investigation, through containment and eradication Perform forensic analysis, implement incident response procedures, and analyze malware as it presents itself Identify attack vectors, threat tactics, and attacker techniques Provide reports, both written and verbal, to clients Provide after-hours support, as needed, based on the investigation Contribute to process development and documentation regarding the IR lifecycle Work with the SOC to enhance detection capabilities based on indicators detected in an IR engagement Technology Strong hands-on working knowledge of: Windows, macOS, and Linux operating systems and forensic analysis techniques Common attack methods, threat actor tactics, techniques, and procedures (TTPs), and the ability to respond strategically and tactically Scripting languages (such as PowerShell, Python, or Bash) to automate tasks or support investigations Microsoft 365, Exchange Online, Microsoft Defender, Azure/Microsoft Entra ID, and Google Workspace environments Forensic and investigative tools to determine the scope and impact of a compromise Knowledge and Skills 1 to 3 years of experience in a forensic and incident response role Experience performing host- and/or network-based digital forensic investigations Experience conducting malware analysis and investigating advanced cyber threats Experience investigating ransomware incidents and other major cybersecurity events Demonstrated experience leading Business Email Compromise (BEC) investigations, including analysis of Microsoft 365, Exchange Online, Azure/Microsoft Entra ID, and Google Workspace environments to identify identity compromise, mailbox persistence, attacker activity, and support containment and remediation. Knowledge of emerging cyber threats, vulnerabilities, and current security research Excellent analytical, critical thinking, and problem-solving skills Ability to remain calm, focused, and effective while managing high-pressure security incidents Strong written and verbal communication skills, with the ability to explain technical findings, risks, and recommendations to both technical and non-technical audiences Ability to adapt quickly in a fast-paced, evolving environment A passion for continuous learning and professional growth in cybersecurity Compensation The anticipated base salary range for this position is $90,000 - $100,000 annually. Actual compensation will be determined in good faith based on factors such as relevant experience, technical expertise, certifications, geographic location (where applicable), and internal equity. This position may also be eligible for bonus or other incentive compensation, as well as the benefits described below. Who we are At Pondurance, we embrace, educate, and protect people by helping make our world a better and safer place. We believe in inviting good people into our company who are driven to become great! Every person at Pondurance is encouraged to focus and grow in their individual areas of interest, passion, and career path. We have accessible leaders as Mentors who believe “None of us are as smart as all of us” (R. Pelletier). We believe everyone has the freedom to be themselves, especially at work, and so we embrace, support, and celebrate each other. Each one of us influences our company’s direction through speaking up; you have a voice, and we want you to use it. Do you want to be a part of something different? Do you want to influence real change? Do you want to be part of the solution? Then join us in redefining the security and cyber risk landscape. What We Offer The opportunity to apply your expertise, take on new challenges, and help customers address their biggest security objectives. An inclusive culture of teamwork that embraces the diversity of our people and communities in which we work. Some of the corporate benefits (there are more) for full-time employees include: Medical, dental, vision, disability, FSA, HSA, life and AD&D insurance, 401(k) Plan. Time off: PTO, sick, holiday, & parental leave details are available Money: We provide competitive compensation packages based on the market and your overall credentials. Although this is a remote role, if you live close by, you’ll have access to our office located in McLean, VA. To promote a healthy and safe work community, we require background and drug screenings as part of our hiring process. Details of our process will be provided upon request. We are an equal opportunity employer focused on celebrating diversity and inclusion. We believe that each individual should be treated equally without regard to race, color, identity, national origin, protected veteran status, religion, sex, including sexual orientation and gender identity, disability, or any other characteristic protected by law.