Jobs in the United States

25+ jobs

Save this search

Added just now
Applied Research Lead, AI for Teaching
Stanford
Stanford, CA
Lead multidisciplinary teams that span the lab and partners’ product and engineering teams.
Added 1 min ago
I
Sr. Data Scientist
Immuta
College Park, MD · Columbus, OH · Boston, MA
- $148,500 to $170,500 USD / year
Build, validate, and improve scoring and prioritization models, including account-readiness, ideal customer profile, and lead-qualification models.
Added 3 mins ago
Data Engineer
FIS Global
Atlanta, GA
You will lead the engineering and operational delivery of enterprise data integration solutions that move Capital Markets data into Snowflake. You will combine hands-on Qlik Replicate and…
Added 3 mins ago
Engineer Lead, Data
FIS Global
Atlanta, GA
You will lead the design and delivery of enterprise data-platform capabilities centered on Snowflake. You will combine hands-on engineering with technical leadership to improve secure data…
Added 5 mins ago
H
Personal Systems Business Planning Manager
HP
Spring, TX
- $130,700 to $185,000 USD / year
Organizes and leads recurring meetings, including PS Cat Ops Staff Meetings, SIOP Reviews and Cat Ops Team Lead Meeting, where he is the meeting organizer and distributes follow‑up notes…
Added 5 mins ago
Flight Software Engineer (Experienced/Senior)
The Boeing Company
El Segundo, CA · Mountain View, CA
Lead the design, integration, modification, test, and debugging of software that is integrated into embedded devices and systems and meets industry, customer, safety and regulation standards
Added 6 mins ago
Site Reliability Engineering (SRE ) lead
U.S. Bank National Association
Gresham, OR
Lead the troubleshooting and resolution of complex production incidents, including application failures, API issues, cloud platform outages, performance degradation, and operational…
Added 6 mins ago
Field Services Enablement Specialist, Technical Consulting
Ridgeline
Remote, United States
Develop and own technical learning paths and curriculum for Ridgeline Academy, preparing internal consultants and partner consultants to independently lead customer implementations
Added 7 mins ago
Manufacturing Application Developer
Voyager Technologies, Inc.
Pittsburgh, PA
…progress, fortify national security, and protect critical assets to lead in the race for technological and operational superiority from ground to…
Added 8 mins ago
Manager, Medical Economics
Centene Management Company LLC
Remote, United States
Lead the planning and execution of enterprise-wide analytics projects and strategic initiatives, translating business goals into actionable solutions.
Added 9 mins ago
Director, Network Observability & Compliance
at Marriott
Bethesda, MD
…are seeking a highly skilled and motivated professional to lead our Network Observability and Compliance function. This role is critical in ensuring the reliability, visibility, and…
Added 10 mins ago
Senior Data Analyst
Trustees of University of Pennsylvania
United States
Faculty Data Projects: Serve as project lead for full life cycle of compilation, analysis, and reporting on faculty activity and performance for the Dean and Deputy Dean. Collect, compile,…
Added 10 mins ago
Senior Manager, Forward Deployed Engineering
Workday, Inc.
CA
…customer execution across Agent Factory, Sana, Products, and the Developer Platform. When Workday launches new AI agents and products, early deployments surface complex real-world…
Added 10 mins ago
Senior Forward Deployed Engineer (FDE) - Developer Platform
Workday Limited
CA
…customer execution across Agent Factory, Sana, Products, and the Developer Platform. When Workday launches new AI agents and products, early deployments surface complex real-world…
Added 11 mins ago
Sr. Systems Engineer - CCA
TD SYNNEX CALA, Inc.
Miramar, FL
The Sr Systems Engineer – Cybersecurity is the technical lead for the CrowdStrike brand in the CCA (Caribbean Central America) region. The role owns presales engineering and architecture…
Added 13 mins ago
Infrastructure Operations Lead
Garda Capital Partners
WYZ, MN · Wayzata, MN
Garda is seeking an Infrastructure Operations Lead to combine hands-on technical work with direct management of the US team. This person owns infrastructure operations and workplace support…
Added 13 mins ago
Business Analytics Lead
PNC Bank NA
PA
…contribute to the company’s success. As a Business Analytics Lead within PNC's Finance organization, you will be based in Pittsburgh,…
Added 14 mins ago
ML/AI - Supply Chain
Samsara
Remote, United States
Real hardware supply chain: Complex multi-tier supplier networks, lead times, high-stakes NPI ramps
Added 17 mins ago
G
Engineer I - Forward Deployed Engineer
GSK
Cambridge, MA
- $95,700 to $159,500 USD / year
Contributes to prototyping under the direction of Lead and Senior FDEs - shipping working AI proofs of concept with BU teams.
Added 17 mins ago
AI Solutions Architect / Forward-Deployed Engineer
Watsco Inc.
Orlando, FL
Lead stakeholder alignment across executives and delivery teams, communicate tradeoffs and realized value, and scale successful solutions through reusable standards and components.
Added 19 mins ago
ZC
Principal AI Security Engineer
Zip Co Limited
United States
- $203,000 to $254,000 USD / year
Lead the technical direction for securing AI applications, autonomous agents, and AI-enabled engineering workflows at Zip.
Added 19 mins ago
Data Engineer II
Numerator
Chicago, IL
Lead complex, end-to-end projects focused on improving data quality and ensuring statistical models are supported by clean and validated data
Added 26 mins ago
Global Category Sourcing Manager - PCBA, Amazon Leo
Amazon Kuiper Manufacturing Enterprises LLC
Bellevue, WA
- Effectively lead cross-functional meetings with clear document writing, agenda creation, note capture and follow-up activity coordination
Added 26 mins ago
System Development Engineer, GenAI and Agentic ADC
Amazon Development Center U.S., Inc.
Arlington, VA
The GenAI and Agentic ADC Developer Experience team is at the forefront of delivering AWS Agentic AI cloud services to our customers in classified environments. We are dedicated to pushing…
Added 26 mins ago
Sr. Manufacturing Test Engineer, AWS Rack Mfg Operations
Amazon Data Services, Inc.
Hebron, KY
Build and Scale Test Software: Design and maintain production test software and automation frameworks using Python, Bash, and related tooling, including test sequencing, equipment control,…

LevelBlue LLC

Sr. Incident Examiner/Negotiator, DFIR

United States

Apply About employer

Applications open in a new tab.

Job details

Posting language: English
Posted: Nov 3, 2026

Original job description

LevelBlue reduces risk and builds lasting resilience so organizations can innovate and advance their mission with confidence. As the world’s most analyst-recognized and largest pure-play managed security services provider, LevelBlue elevates client outcomes that matter: stronger defense, faster response, and sustained business continuity. LevelBlue combines AI-powered security operations, advanced threat intelligence, and elite human expertise to provide the most comprehensive portfolio of strategic advisory, managed security, offensive security, and incident response services.

Position Summary:

We are seeking a highly skilled and motivated Digital Forensics and Incident Response (DFIR) practitioner to join our Global LevelBlue DFIR team. The ideal candidate will be responsible for investigating and responding to cybersecurity incidents, conducting digital forensic and incident response investigations, and working independently against engagement milestones from forensics to log analysis to report writing.

In addition to core DFIR responsibilities, this practitioner will possess the experience, background, and judgment in conducting Threat Actor (TA) communications and data encryption (ransomware)/extortion negotiations when required as part of a digital forensics and incident response engagement.

This role requires deep technical expertise, strong analytical and communication skills, sound judgment, and the ability to operate effectively under pressure in fast-moving and high-stakes incidents.

This role requires being available during team on call scheduling.

Key Responsibilities:

Digital Forensics & Incident Response:

Be able to lead and coordinate responses to cybersecurity incidents, including identification, containment, eradication, and recovery.
Analyze and investigate security breaches to determine the root cause and impact.
Conduct digital forensic science-based incident response investigations on a variety of digital devices, including servers and end user workstations, network systems, SaaS platforms that contain artifacts, logging, and data of investigative relevance.
Collect, preserve, and analyze digital evidence in accordance with legal and regulatory requirements.
Remain available to support time-sensitive communications during active ransomware or extortion incidents, including incidents requiring coordination across time zones and outside normal business hours.

Threat Actor Communications & Negotiation:

Conduct direct, controlled communications with ransomware and extortion Threat Actors on behalf of clients, in coordination with engagement leadership, breach counsel, insurers, and other authorized stakeholders.
Develop and execute communication and negotiation strategies based on the client’s business objectives, operational impact, legal guidance, incident facts, Threat Actor behavior, and available threat intelligence.
Establish and maintain secure communication channels with Threat Actors while preserving complete and accurate records of communications, demands, representations, deadlines, and negotiation activity.

Assess Threat Actor identity, credibility, behavior, historical patterns, proof-of-compromise or proof-of-exfiltration claims, and other available intelligence to inform negotiation strategy and client decision-making.

Manage the cadence, tone, sequencing, and content of communications to obtain information, validate claims, preserve options, manage time, and reduce unnecessary disclosure of client information or negotiating position.
Support ransomware and extortion negotiations, including demand assessment, counteroffer strategy, time extensions, proof requests, data deletion or non-publication representations, decryptor validation coordination, and settlement-related communications when authorized.
Provide clear, timely briefings to client leadership, counsel, insurers, and the DFIR engagement team regarding Threat Actor communications, negotiation posture, risks, decision points, and recommended next actions.
Coordinate TA communications with the broader DFIR investigation so that information learned through negotiations can inform forensic analysis, scoping, containment, threat intelligence, and recovery activities, and technical findings can inform the negotiation strategy.
Maintain strict confidentiality, professional ethics, independence, and need-to-know handling of client financial information, insurance information, negotiation authority, legal strategy, and other sensitive information that could affect the client’s negotiating position.
Remain available to support time-sensitive communications during active ransomware or extortion incidents, including incidents requiring coordination across time zones and outside normal business hours.

Cloud Digital Forensics:

Training and experience in conducting analysis within cloud environments (e.g., Azure, AWS, GCP, Oracle) focused on identity abuse, privilege escalation, persistence mechanisms, and lateral movement.
Analyze Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) specific to cloud intrusions.
Identify misuse of APIs, service principals, roles, and OAuth applications.

Identity and Access Investigations:

Investigate compromise involving IAM roles, Azure AD/Entra ID identities, service accounts, and federated access.
Analyze authentication patterns including impossible travel, token abuse, and anomalous API usage.
Assess privilege escalation paths and access persistence mechanisms.

Reporting and Documentation:

Be able to prepare detailed incident reports, including findings and properly authoring a story that does not just restate factual dates/times, but articulates a story of the incident for a non-technical audience.
Maintain accurate and thorough documentation of all incident response activities and forensic investigations.

Collaboration and Communication:

Internally, work closely with cross-functional teams inclusive of DFIR, Advisory, Testing, Threat Intelligence, MDR/MSS, etc. LevelBlue services.
Externally, work closely with Client teams including IT, legal, compliance, and external vendors, to support expert delivery during engagements.
Communicate effectively with stakeholders to provide updates and ensure alignment with incident response processes.

Qualifications:

Strong knowledge of digital forensics tools and techniques, including X-Ways, or similar forensic tooling.
Experience with incident response frameworks and methodologies (e.g., NIST, SANS, etc).
Excellent analytical and problem-solving skills.
Strong understanding of network protocols, operating systems, and security technologies.
Excellent written and verbal communication skills.
Ability to work independently and manage multiple projects simultaneously.
Demonstrated experience conducting or materially supporting Threat Actor communications, ransomware negotiations, cyber extortion negotiations, crisis negotiations, or comparable high-stakes adversarial communications.
Ability to communicate calmly and deliberately in high-pressure situations and to distinguish investigative facts, Threat Actor claims, assumptions, and negotiation positions.
Understanding of ransomware and data-extortion ecosystems, common Threat Actor communication methods, leak sites, negotiation portals, cryptocurrency-related settlement workflows, and the operational considerations associated with ransomware response.
Experience using threat intelligence and prior Threat Actor behavior to support attribution assessment, credibility analysis, negotiation planning, and client risk decisions.
Strong written documentation skills for maintaining contemporaneous communication logs, negotiation summaries, decision records, and stakeholder updates.

Preferred Qualifications:

Bachelor's or Masters degree in Digital Forensics, Computer Science-focused or closely related field of study and expertise.
Certification(s) in DFIR
Knowledge of scripting languages (e.g., Python, PowerShell) for automation and analysis.
Knowledge of database formats for investigative and knowledge purposes
Prior experience in law enforcement and/or crisis negotiation is a consideration and may be beneficial for candidates with otherwise strong DFIR qualifications.
Formal training or demonstrated experience in crisis negotiation, ransomware negotiation, behavioral analysis, threat intelligence, HUMINT, or adversarial communications.
Experience coordinating ransomware or extortion matters with breach counsel, cyber insurers, law enforcement, payment/settlement providers, and executive stakeholders.

Why Join LevelBlue? At LevelBlue, you’re not just an employee - you’re part of a team making a real difference in the world of cybersecurity. We foster a culture of innovation and creativity where your contributions are valued, and you’ll have the support and resources to grow and thrive.

Benefits and Perks:

Comprehensive medical, dental, and vision insurance.
401(k) with employer matching.
Generous paid time off and holidays.
Flexible spending accounts and health savings accounts.
Employee assistance programs.
Training and development opportunities.
Adoption assistance program.

This role is open to candidates legally authorized to work in the United States. At LevelBlue, we support flexible work and bring people together in person for key moments based on role, team, and business needs.

LevelBlue is committed to a culture of respect, inclusion, and equal opportunity. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age, or any other status protected under applicable law.

To all agencies: Please do not contact LevelBlue employees outside of the Talent Acquisition team. LevelBlue’s policy is to only accept resumes from agencies through its approved agency process and with a valid agreement in place. Any resume submitted outside this process will be considered the property of LevelBlue, and no fee will be paid if a candidate is hired from such a submission.

Apply About employer

Report this job