Principal Consultant, DFIR; Weekend - Unit

Our Mission

At Palo Alto Networks® everything starts and ends with our mission:
Being the cybersecurity partner of choice, protecting our digital way of life. Our vision is a world where each day is safer and more secure than the one before. We are a company built on the foundation of challenging and disrupting the way things are done, and we’re looking for innovators who are as committed to shaping the future of cybersecurity as we are.

We take our mission of protecting the digital way of life seriously. We are relentless in protecting our customers and we believe that the unique ideas of every member of our team contributes to our collective success. Our values were crowdsourced by employees and are brought to life through each of us everyday – from disruptive innovation and collaboration to execution.

From showing up for each other with integrity to creating an environment where we all feel included.

This role is client‑facing and requires the Principal Consultant to lead and produce deliverables based on reactive services client engagements. The Principal Consultant will work directly with multiple customers and key stakeholders (Admins, C‑Suite, etc.) to manage incident response engagements and provide guidance on longer‑term remediation.

• Weekend work schedule:
  Friday‑Monday (10 hr work day/ 40 hr work week)
• Perform reactive incident response functions, including host‑based analysis of Windows, Linux, and Mac OS X systems to identify indicators of compromise (IOCs)
• Examine firewall, web, database, and other log sources to identify evidence of malicious activity
• Investigate data breaches using forensic tools such as Encase, FTK, X‑Ways, SIFT, Splunk, and custom Crypsis tools to determine the source of compromises and malicious activity in client environments
• Manage incident response engagements to scope work, guide clients through forensic investigations, contain security incidents, and provide guidance on longer‑term remediation recommendations
• Travel as needed to meet business demands (average 20%)
• Mentor team members in incident response and forensics best practices
• 8 years of incident response or digital forensics consulting experience with a passion for cyber security
• Strong leadership skills, including experience managing a team or individuals
• Experience leading complicated engagements, including scoping, interfacing with the client, and executing on a technical front
• Proficiency with host‑based forensics and data breach response
• Extensive knowledge of forensic tools such as EnCase, FTK, X‑Ways, SIFT, Splunk, Redline, Volatility, Wire Shark, TCPDump, and open‑source forensic tools
• Incident response consulting experience required
• Ability to grow into a valuable contributor to the practice and, specifically, a public presence via conferences, speaking, and/or publications
• Credibility, executive presence, and gravitas
• Ability to deliver meaningful and rapid contributions
• Potential and capacity to understand all aspects of the business and an excellent understanding of PANW products
• Collaborative and able to build relationships internally, externally, and across all PANW functions, including the sales team
• Bachelor’s Degree in Information Security, Computer Science, Digital Forensics, Cyber Security or related field or equivalent military experience (required)

Please note that this role requires eligibility for UK Security Check (SC) Clearance. Eligibility includes having spent the last five years in the UK and holding British citizenship. Unfortunately, if you do not meet these requirements, we will be unable to proceed with your application.

Unit 42 Consulting is Palo Alto Network’s security advisory team. Our vision is to create a more secure digital world by providing the highest quality incident response, risk management, and digital forensic services to clients of all sizes. Our team is composed of recognized experts and incident responders with deep technical expertise and experience in investigations, data breach response, digital forensics, and information security.

With a highly successful track record of delivering mission‑critical…