Bachelor's degree (Master's preferred) in Cybersecurity, Computer Science & Engineering, Digital Forensics, Management Information Systems, Security Information Systems or related field; 5-7+ years in cybersecurity incident response, digital forensics, or enterprise recovery, including 3+ years leading engagements or teams; Certifications such as CISSP, GCFA, GCIH, CISM, or equivalent; advanced degree in a relevant field a plus; Track record leading large-scale ransomware recovery or complex intrusion matters in enterprise environments (thousands of endpoints, multi-site); Strong command of hybrid Microsoft identity architecture (Active Directory, Entra ID, Conditional Access, privileged access models) at a level sufficient to direct and validate technical work; Experience working under legal privilege and managing the counsel and carrier dynamics of breach response; Demonstrated ability to scope and price engagements accurately, and to manage delivery to fixed-price commitments; Executive-grade written and verbal communication; comfortable briefing boards, GCs, and CISOs; Ability to work evening and weekends; incident response work involves surge periods, including nights and weekends during active engagements. Prior consulting experience at a professional services firm, IR boutique, or carrier panel firm; Existing relationships with breach counsel or cyber insurance carriers; Experience testifying or supporting expert work product in litigation or regulatory contexts; Background in security assessment methodologies and compliance frameworks (NIST CSF, CISA SCuBA, CMMC).