DFIR Lead

Role Overview

Responsibilities

• Lead and mentor the DFIR team and perform daily management tasks.
• Coordinate triage, containment, eradication, and remediation in unknown customer environments.
• Conduct root-cause forensic investigations for incidents and breaches.
• Create and maintain standard and customer-specific incident response plans, policies, and procedures.
• Analyze security logs and data from antivirus, IDS/IPS, firewalls, switches, VPNs, and other sources.
• Analyze RAM, packet captures, logs, and disk images.
• Reverse engineer malicious software and create signatures and indicators of compromise.
• Develop response tools, scripts, detection content, queries, rules, watchlists, and threat hunts.
• Support managed-services technical requests and work at client sites during live incidents, potentially outside the country.
• Prepare customer reports and guide junior incident response and forensic investigators.

Qualifications and Skills

• Degree in Computer Science, Information Systems, Electrical Engineering, or a closely related field.
• 10+ years of information security experience.
• 2-3 years as a Senior or Lead Analyst, or equivalent team-guidance experience.
• One required certification: CISSP, GCIA, GCIH, GCFA, GCFE, GREM, or OSCP.
• Background in four specified security domains, including threat analysis, network security, forensics, reverse engineering, malware analysis, penetration testing, or directory and cloud administration.
• Experience with incident response methods, log analysis, digital forensics tools, malware analysis, detection rules, scripting, TCP/IP, and networking.
• Experience handling APT and ransomware engagements using the SANS incident response method or similar.

Benefits

• Health insurance, annual flight tickets, learning and development opportunities, and career progression.
• Flexible and hybrid working environment.
• Employee engagement, wellness campaigns, and an inclusive work environment.

About Help AG