Head of DFIR

🚨 We're Hiring: Senior DFIR Lead – Build and Lead Our Incident Response Team

📍 Location: Tel Aviv, Israel | 🏢 Company: Code Blue Cyber

At Code Blue Cyber, we help organizations prepare for, respond to, and recover from cyber crises. With deep operational experience and a proven track record managing high-impact incidents worldwide, we reduce downtime, minimize financial and regulatory impact, and protect reputations when it matters most.

Headquartered in Tel Aviv and serving clients globally, we’re building the next generation of cyber crisis leadership.

We are looking for a seasoned Senior DFIR (Digital Forensics and Incident Response) Lead to establish and lead our Incident Response team.

This is a hybrid role that combines deep technical expertise with strategic leadership. The ideal candidate has experience managing complex cyber incidents and forensic investigations in large enterprise environments, and is ready to build out capabilities, lead analysts, and serve as a trusted advisor during critical moments.

• Build and manage Code Blue’s internal DFIR capabilities
• Lead forensic investigations and full-lifecycle response to ransomware, APTs, insider threats, and complex attacks
• Develop IR playbooks, workflows, and methodologies tailored to enterprise environments
• Coordinate high-stakes incident response across technical, legal, and executive teams
• Conduct post-incident reviews and produce actionable lessons learned
• Perform disk, memory, and network forensics using industry-standard tools
• Produce formal forensic investigation reports in accordance with ISO/IEC 27037, chain-of-custody principles, and forensic admissibility standards
• Collaborate with threat intelligence, detection engineering, and client SOC teams

• 5+ years of hands-on DFIR experience, including 2+ years in a lead or senior position
• Proven track record of leading investigations and incident response in large organizations
• Experience managing high-severity incidents involving ransomware, data breaches, or APT actors
• Strong technical knowledge of Windows/Linux internals, file systems, registry, and network protocols
• Proficiency with forensic and IR tools such as:
• EnCase, FTK, X-Ways, Autopsy
• Volatility / Rekall (memory forensics)
• SIEM and EDR platforms (Splunk, SentinelOne, CrowdStrike, etc.)
• Ability to manage multiple stakeholders under pressure and communicate clearly with both technical and non-technical audiences

• GCFA – GIAC Certified Forensic Analyst
• GCIH – GIAC Certified Incident Handler
• GREM – GIAC Reverse Engineering Malware
• OSCP, OSCE, CISSP, or CISM – additional assets

• A rare opportunity to build and lead a high-impact IR team from the ground up
• Work on critical incidents with enterprise clients worldwide
• Competitive compensation, benefits, and professional development support
• A mission-driven company with a strong sense of purpose and ownership

Send your resume and a short cover letter to:

📧 [email protected]

💥 Make an impact where it matters most.

Join Code Blue Cyber – where incident response becomes resilience.