DFIR Manager - building in-house IR diverse portfolio - Dallas TX

This is a chance to own incident response across an entire group of businesses, spanning financial services, sport and technology.

The group is bringing security operations in-house and needs a DFIR Manager to build out the function across every business, each facing different threats and regulators.

Some foundations are in place, and your job is to mature them into a properly run function. You’ll own the IR plan and playbooks for each business, run tabletop exercises, build the forensic lab and grow a team around you. When a major incident hits, you’ll lead the response as incident commander through to recovery, working with IT, Legal, HR and leadership.

It’s a hands-on role, with most evidence in Microsoft 365 and Entra, alongside disk, memory, network and cloud forensics.

You have built IR programs and playbooks yourself, not just followed them. You have sat in the incident commander seat on serious incidents like ransomware or breaches and coordinated IT, Legal, HR and leadership through to recovery. You have designed and run tabletop exercises and you know how to handle the business, legal and comms side of an incident, not only the technical response.

This is a hybrid role based in Dallas.