Digital Forensics and Incident Response (DFIR) analyst

Overview

Senior DFIR professional responsible for leading complex cyber investigations, strengthening enterprise resilience, and advising security teams during critical incidents across global environments.

What you'll do

• Lead incident response and cyber crisis engagements from detection through recovery.
• Direct host, network, cloud, identity, and SaaS investigations.
• Perform threat hunting and compromise assessments using security platforms.
• Develop containment, eradication, and remediation strategies.
• Produce executive briefings, technical reports, and post-incident reviews.
• Partner with legal, compliance, privacy, audit, and external stakeholders.
• Support the 24/7 on-call rotation.

What you'll need

• 5+ years in incident response, DFIR, security operations, consulting, or related cybersecurity disciplines.
• Experience leading major incidents involving ransomware, email compromise, insider threats, cloud compromise, supply chain attacks, or advanced persistent threats.
• Strong digital forensics capability with industry-standard forensic and triage tools.
• Experience with Splunk, Microsoft Defender, CrowdStrike Falcon, ServiceNow SIR, and cloud security technologies.
• Knowledge of network protocols, detection engineering, log analytics, and threat hunting.
• Mandatory experience with FTK, EnCase, X-Ways, Magnet Axiom, SIFT, or other forensic tools.
• Strong communication and prioritization skills for technical and executive audiences.

Nice to have

• Industry certifications such as GCFA, GCFE, GCIH, GCIA, CISSP, CISM, Azure Security Engineer, or AWS Security Specialty.
• Bachelor's degree in cybersecurity, computer science, information security, engineering, intelligence studies, or a related discipline.

Details

• Remote or hybrid eligible.
• Travel is not required for standard day-to-day duties.
• Supports global operations across multiple regions and time zones.