Incident Response; DFIR Case Manager - Cybersecurity

Position: Incident Response (DFIR) Case Manager - Cybersecurity
Job Type

Full-time

Description

Why choose FRSecure? We believe information security is fun. We focus on equipping our clients, communities, and employees with knowledge to better protect themselves against risk. Our first core value, we tell the truth, sets a foundation for meaningful relationships and employee growth, ultimately providing the highest quality work in the industry. We are consistently awarded for outstanding service, industry-leading methodology, organizational growth, and a reputable culture.

Our benefits are something to talk about as well. We offer a flexible and rewarding work environment, medical, dental and vision insurance, HSA/FSA/DCA accounts, life and disability insurance, 401(k) with employer match up to 4%, employee assistance program (EAP), unlimited paid time off, paid parental leave, education/growth assistance, pet insurance, and more.

We are experts on a mission to fix the broken information security industry. We believe that behind every data compromise are people, and everyone deserves to have their data and livelihood protected. We take great pride in what we do and how we do it, and we truly believe we can accomplish our mission. It starts with hiring the right people to help us get there.

If this resonates with you, apply now to join our dedicated team!

Position Summary: The Incident Response (DFIR) Case Manager is responsible for providing support to clients when they have become or suspect they may be the victim of a cyber-attack. This is done by conducting high quality and timely incident response investigations in environments of varying security maturity including identification and containment phases and advising clients regarding recovery and remediation steps to assist them in returning to normal business operations.

Our Incident Response Case Managers have a blend of proactive project responsibilities, such as leading tabletops and plan coaching, as well as triage and case work.

Working Location: This position is available on a full-time remote basis in the following states: Arizona, Colorado, Florida, Georgia, Idaho, Illinois, Kansas, Kentucky, Massachusetts, Michigan, Minnesota, Montana, North Carolina, Ohio, Pennsylvania, South Dakota, Tennessee, Texas, Washington, and Wisconsin. Only candidates located in the United States will be considered. Office headquarters and operational business hours are based in Edina, MN (Central Time).

Final date to receive applications: June 5, 2026

What Your Day Looks Like as an Incident Response (DFIR) Case Manager:

• Performing a forensic review of client systems for artifacts and indicators of compromise (IOCs) to further identify, contain, and eradicate malware and/or malicious intruders
• Conducting triage, threat-hunting, and case management for incident response clients
• Documenting detailed evidence, findings, and create a report output
• Meeting with clients during the planning, information sharing, and technical support stages
• Creating and delivering proactive projects to clients including tabletop exercises, plan coaching, assessments
• Conducting regular calls with clients to consult on incident response programs
• Continue education by researching and investigating developments in cyber forensics/attack methodologies; increase existing skillset to handle these matters
• Attending and participating in regular internal meetings
• Participating in on-call rotation, providing timely and effective support to clients, ensuring adherence to service level agreements (SLAs) and resolving issues within established response and resolution times
• Performing periodic after-hours and weekends on-call work

Working Hours: Standard working hours for this position are between 8:00am-5:00pm in the time zone in which the employee is based, with the expectation that there may be client calls, project/task responsibilities, meetings, or other company obligations in which the employee will need to work outside of these hours, as standard business hours are 8:00am-5:00pm Central Time.

This position also includes on-call responsibilities. On-call duty will be 1 week in duration with the on-call assignment being dependent upon the number of Case Managers on the team. During the on-call rotation, the employee will be required to monitor an email inbox for incoming CSIRT requests as well as answer incoming calls to the CSIRT after-hours hotline and perform incident triage duties.

Travel: There is minimal travel associated with this position, typically less than 5-10%. Occasional travel includes conferences or on-site client projects as needed, as well as any team or company activities.

Requirements

What You Bring to the Incident Response (DFIR) Case Manager role:

• 3-5 years of information security experience
• 3-5 years of experience with Active Directory, Systems Administration, Exchange Administration, M365 and/or other cloud environments
• 3-5 years of experience in presenting information security concepts
• GCIH, GCFA, ECIH certifications preferred
• Prior experience in threat hunting…