Digital Forensics and Incident Response (DFIR) analyst

Role overview

Key responsibilities

• Lead enterprise incident response and cyber crisis engagements from detection through recovery.
• Direct host, network, cloud, identity, and SaaS investigations across Windows, Linux, macOS, Microsoft 365, AWS, Azure, and hybrid environments.
• Conduct threat hunting and compromise assessments using SIEM, EDR, forensic, and threat-intelligence platforms.
• Develop containment, eradication, and remediation strategies aligned to business risk.
• Produce executive briefings, technical reports, board-ready updates, and post-incident reviews.
• Partner with legal, compliance, privacy, audit, and external stakeholders as needed.
• Drive AI-assisted workflows to improve investigation speed, reporting quality, and operational efficiency.
• Participate in the 24/7 on-call rotation.

Required experience and expertise

• At least 5 years in incident response, DFIR, security operations, consulting, or a related cybersecurity discipline.
• Experience leading major incidents involving threats such as ransomware, business email compromise, insider threats, cloud compromise, supply chain attacks, or advanced persistent threats.
• Strong digital forensics capability using industry-standard tools; experience with FTK, EnCase, X-Ways, Magnet Axiom, SIFT, or other forensic tools is mandatory.
• Experience with Splunk, Microsoft Defender, CrowdStrike Falcon, ServiceNow SIR, and cloud security technologies.
• Knowledge of network protocols, detection engineering, log analytics, and threat-hunting methodologies.
• Excellent verbal and written communication for technical and executive audiences, and ability to manage multiple priorities in a global enterprise.

Education and certifications

• Industry certifications such as GCFA, GCFE, GCIH, GCIA, CISSP, CISM, Azure Security Engineer, AWS Security Specialty, or comparable credentials are desirable, not mandatory.
• A bachelor's degree in Cybersecurity, Computer Science, Information Security, Engineering, Intelligence Studies, or a related discipline, or equivalent experience, is desirable, not mandatory.

Work environment

• Remote or hybrid eligible.
• The role supports global operations and may engage stakeholders across regions and time zones.
• Travel is not required for standard day-to-day duties; participation in an on-call rotation is required.