Difficult or "gated" specialties (like automotive) command higher bill rates --- so hardware, automotive, cryptography, maybe some kernel work (I don't know anyone that has a formal specialty practice in "kernel", it bleeds into other stuff).

IR is a huge practice area, lots and lots of people do it, and the line-level consulting work here is stuff that isn't at all difficult or specialized (log file analysis, imaging). There's specialty work in IR too, of course (there are firms that specialize in memory forensics, for instance), and that bills higher.

Mandiant is like the PwC of IR firms; Mandiant can get contracts that bill basic log file analysis out at $3k/day, because they're Mandiant. That doesn't mean the person doing that work is seeing proportionally more income themselves, or that a team of people striking out on their own from Mandiant are going to be able to bill comparably.

On the other hand, a team of cryptographers or hardware reversers at a big firm probably could expect to see comparable bill rates after starting up their own firm.