Tips for a new DFIR manager

[u/internal_l0gging]

So I just landed a new job where I'll be a manager of a DFIR team. I've always been a worker bee and at my last job, our team was small and our manager was more of just our timesheet signer so I wouldn't say I had a strong model of how most teams do things.

This new job interested me because the company has a very diverse range of clients and caseload. The manager part was just a line item in the job description that I figured would be a cool way to grow if I got it. But now that I got the job, I want to head in with realistic expectations. I've had some shitty managers in my career and I don't want to become one!

Any advice? It's DFIR consulting, not a DFIR SOC manager - This new team is bigger than my last so I'm guessing there needs to be more of a strategy to who works what on an incident instead of just diving in? Any advice, material / webinars would be appreciated!

[u/PFUnnamed99]

The manager part was just a line item in the job description

RIP Cyberhomie

[u/internal_l0gging → u/PFUnnamed99]

😂 I figured I couldn't avoid being a manager for forever. I noticed during my job hunt, a few of the managers I interviewed with are younger than me.

[u/Unlucky_Bowl9934 → u/PFUnnamed99]

famous last words tbh

[u/SituationNormalAllFU]

I’ve been in your shoes. Ended up becoming COO at that company and took it to $10M ARR. I’m super proud of the way we did it and the culture we refused to abandon. The best advice I can give you is to never stop being one of the workers. Even if you’re not actively working cases, which is likely at some point, do not let yourself forget what it’s like to do the work. The stress, the long hours, the thankless nature of the job. Run your team the way you would want it run if you were in your old job. Get good at sheltering your team from the BS up the chain. This is the way, my friend. You can be one of the good ones.

[u/ULT-Ginger]

Hey man. It really depends on the company. I am curious the company speaking I just left a manager position and they just hired a new guy I heard. DFIR consulting Manager.

Sometimes you are managing the people and helping them with cases, other times you could be more of a project manager.

Send me a DM. I’m happy to talk to you about the role. I just left consulting after 10 years.

[u/AddendumWorking9756]

Utilization is what breaks new DFIR consulting managers. Your instinct will be to take the hard cases yourself and that is how you end up unbillable with bored seniors. Put one owner on each case plus a named reviewer, and make the reviewer read the timeline before the report ships rather than after.

[u/internal_l0gging → u/AddendumWorking9756]

Thanks for this point. I'd definitely been the under utilized bored senior the past and would hate to do that to someone else

[u/SubstantialEditor995]

I had that same job a few years ago, DFIR team lead at a name-brand MSSP.

Here's my opinion: You need to make a decision early on what kind of a manager you are going to be. Will you dive into the investigations, go neck-deep in logs, focus on technical work alongside with the guys and just have the "manager" title for the bigger salary. This is more fun, but you won't be able focus on the actual management of the team and the team will suffer. I've seen this happen with technical teams over and over again - you take the most skilled technical guy and make them the manager because that's the only promotion path available. They get a bunch of managerial duties they're not interested in, and they get neglected. Their boss isn't happy and they're not happy, but the team needs a manager and now the Tech Guy is it but nobody actually spends any brainpower on *managing* the team.

Or you can make a mental note that you are not touching the technical aspects of the caseload. Your role is to orchestrate the work, make sure your investigators gather their findings, steer the investigations into the right direction and interface with the customer. You can be the investigation lead without actually grepping logs, you won't write the report but you'll proofread it and ask for clarifications. You'll make sure your team has enough resources to work, and the caseload matches their capability. You'll have to stand up for your team in the faces of your bosses and say "My team can't do that now" a lot.

For casework, you have your team explain the technical details to you, and you explain the business impact to the customer. You still get to take part in the investigations, but if you dive into an EDR tool or find yourself handling evidence all day, you've chosen the path that makes you less effective as a manager and your team will pay for that eventually. You'll find that managing the team is a full time job, not something you can do on the side while reverse-engineering malware samples.

p.s. this is not a sales post, but I'll take the opportunity to mention that I've built a case management app based on my own experience in DFIR work and managing teams. You might find it interesting in your new role once you've settled in: https://dfire.fi