Incident Response and Forensic Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Evaluate and address commodity threats alongside intricate advanced intrusions.

• Lead and assist in investigations concerning APT intrusions, malware outbreaks, ransomware incidents, unauthorized cloud access, and data compromises.

• Examine systems and artifacts, including memory, disk images, logs, and network data, to identify root causes and impacts.

• Gather, preserve, and analyze digital evidence across endpoints, servers, cloud environments, and network systems.

• Conduct memory forensics and analyze volatile data.

• Develop and enhance forensic workflows, scripts, and methodologies.

• Generate comprehensive forensic reports, executive summaries, and technical briefs.

• Collaborate with teams in Network Security Monitoring, Threat Intelligence, Engineering, and client services.

• Assist in threat hunting, compromise assessments, and cybersecurity evaluations during mergers and acquisitions.

• Provide guidance to clients on cybersecurity inquiries and overall security posture.

• Safeguard digital evidence and convey clear forensic conclusions.

⛳️ Requirements

• Remote position available (USA).

• Mid-level experience preferred; a senior role may be offered to an exceptional candidate.

• Minimum of 3–5 years of practical experience in digital forensics during security incidents, including evidence collection, preservation, and analysis.

• Expertise in analyzing host and network-based artifacts, such as logs, memory, disk images, and network traffic, utilizing command-line tools and scripts.

• Strong understanding of Windows, Linux, and macOS operating system internals and prevalent attack methods.

• Well-versed in investigating activities within Microsoft 365, Google Workspace, GCP, Azure, AWS, and OCI environments.

• Experience in responding to complex breaches related to web applications, operating systems, embedded devices, and cloud services.

• Ability to comprehend various attack techniques and their connection to specific forensic artifacts.

• Proficiency in Python and Bash scripting.

• Exceptional written and verbal communication skills, capable of documenting and presenting findings to clients.

• Awareness of the current threat landscape and threat actor tactics, techniques, and procedures (TTPs).

• Capability to work effectively both independently and as part of a team.

• Strong grasp of computer memory architecture and memory forensics.

• Familiarity with commercial forensic platforms for Windows, macOS, Linux, and iOS.

• Experience with EDR/XDR platforms such as SentinelOne, Microsoft Defender for Endpoint, and CrowdStrike Falcon.

🏝️ Benefits

• Benefits included in total compensation discussion.

• Equity options available.

• Budget allocated for professional development.