Forensic Consultant

Overview

Fixed-term contract Forensic Consultant who leads forensic analysis of projects assigned to the Tiger Team, performing triage-level and deep-dive forensic analysis to identify threat actor behavior and how a cyber intrusion occurred.

What you'll do

• Lead forensic analysis to support the Forensic lead on ransomware and compromise investigations.
• Work with Tiger Team analysts to analyze operating system artifacts and recover deleted items across Windows, Linux, Mac, and RAM/memory forensics.
• Analyze network and operating system log files, including Windows Event logs, Unified Audit Logs, Firewall logs, and VPN logs.
• Work with the Security Operations Center to leverage EDR alert data to identify Indicators of Compromise (IOCs) or Tactics, Techniques, and Procedures (TTPs) related to the case.
• Prepare forensic findings and updates as a clear, concise narrative timeline of events, adapted to the audience and technical capability.
• Use incident-mapping frameworks such as MITRE ATT&CK and Lockheed Martin's Cyber Kill Chain to contextualize IOCs.
• Review and draft written incident updates, reports, and appendices at the explicit direction of counsel and partners using standard report templates.
• Perform peer reviews of reports written by team members.
• Deliver on the forensic investigations plan and work with the lead to manage timeline, delivery, and execution across projects within the contract period.
• Perform other duties as assigned by management.

What you'll need

• Bachelor's degree in Information Security, Computer Science, Digital Forensics, Cyber Security, or a related field, and 4+ years of incident response or digital forensics experience.
• Thorough knowledge of Windows disk, Unix or Linux disk, and memory forensics.
• Knowledge of Network Security Monitoring (NSM), network traffic analysis, and log analysis.
• Experience and understanding of enterprise security controls.
• Experience with EnCase, Axiom, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, WireShark, TCPDump, and open-source forensic tools.
• Ability to establish priorities, work independently, and proceed with objectives with minimal supervision.
• Strong problem-solving and critical-thinking skills to identify and resolve compliance-related issues.
• Excellent verbal and written communication skills for clear, concise reports and cross-functional collaboration.
• Proficiency in Microsoft Suite products.
• Ability to quickly adapt and contribute in a fixed-term contractual role with minimal ramp-up time.

Nice to have

• Two or more of the following certifications: Security+, Network+, SANS GCED, GCIH, GCFE, GCFA, CEH, CHFI, EnCE.
• Experience delivering technical findings to a non-technical audience.
• Experience leading teams of analysts.
• Providing findings in a confident, factual manner.
• Knowledge and experience handling PII, PHI, sensitive, confidential, and proprietary datasets.
• Experience with cyber insurance investigations.

Details

• Fixed-term contractual role; contract may be extended based on business needs and performance.
• Does not carry the benefits associated with permanent employment.
• Usual office working conditions.