Leads small DFIR workstreams during incident response and recovery engagements, coordinating teams, validating technical outputs, presenting findings, and managing client expectations. Performs forensic acquisition, IOC triage, log analysis, disk and memory imaging, event correlation, timeline construction, threat research, and recovery activities. Maintains case documentation, chain of custody, compliance, and quality standards while participating in on-call rotations and traveling to client sites for deployments.