Consulting Director, DFIR, Reactive Services (Unit 42)

Our Mission

At Palo Alto Networks were united by a shared missionto protect our digital way of life. We thrive at the intersection of innovation and impact solving real-world problems with cutting-edge technology and bold thinking. Here everyone has a voice and every idea counts. If youre ready to do the most meaningful work of your career alongside people who are just as passionate as you are youre in the right place.

Who We Are

In order to be the cybersecurity partner of choice we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption Collaboration Execution Integrity and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real-world problems and ideating beside the best and the brightest we invite you to join us!

Job Summary

Summary
Senior-level consulting role leading cybersecurity incident response and breach investigations for Unit 42 clients. Acts as both a strategic advisor and hands-on technical leader across industries and environments driving outcomes on complex security incidents.

Key Responsibilities

• Lead breach response engagements providing both strategic direction and hands-on DFIR leadership
• Deliver expert consulting across incident response digital forensics and cyber risk scenarios
• Guide clients through complex incidents with tailored high-impact solutions
• Stay current on threat landscape vulnerabilities and attacker techniques (TTPs persistence methods)
• Perform and oversee forensic investigations (memory/disk acquisition analysis) using tools like EnCase FTK Volatility
• Manage client relationships lead technical discussions and run multiple engagements concurrently
• Support business growth through client expansion (cross-sell/upsell) and new opportunity identification

Qualifications

Required Qualifications

• 10 years of DFIR consulting experience (breach response investigations)
• Proven leadership of technical incident response teams in high-pressure environments
• Deep expertise in forensic methodologies (chain of custody disk/memory analysis)
• Hands-on experience with tools: EnCase FTK SleuthKit Volatility (or equivalent)
• Strong operating system expertise (Windows Linux or macOS)
• Degree: Bachelors 12 yrs Masters 8 yrs or PhD 5 yrs (or equivalent experience)

Preferred Qualifications

• Recognized industry leader (speaking media thought leadership)
• Strong client management budget ownership experience
• Experience analyzing novel malware / advanced threats
• Comfortable with up to 20% travel

Compensation Disclosure

The compensation offered for this position will depend on qualifications experience and work location. For candidates who receive an offer at the posted level the starting base salary (for non-sales roles) or base salary commission target (for sales/com-missioned roles) is expected to be the annual range listed below. The offered compensation may also include restricted stock units and a bonus. A description of our employee benefits may be found here.

Our Commitment

Were trailblazers that dream big take risks and challenge cybersecuritys status quo. Its simple: we cant accomplish our mission without diverse teams innovating together.

We are committed to providing reasonable accommodations for all qualified individuals with a disability. If you require assistance or accommodation due to a disability or special need please contact us at .

Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace and all qualified applicants will receive consideration for employment without regard to age ancestry color family or medical care leave gender identity or expression genetic information marital status medical condition national origin physical or mental disability political affiliation protected veteran status race religion sex (including pregnancy) sexual orientation or other legally protected characteristics.

All your information will be kept confidential according to EEO guidelines.