Senior Forensic Analyst

Overview

Leads forensic analysis on ransomware and compromise investigations, supporting the Forensic lead and working with the tiger team analysts.

What you'll do

• Lead forensic analysis to support the Forensic lead on ransomware and compromise investigation engagements.
• Work with tiger team analysts to perform forensic analysis of artifacts, including operating system artifacts and recovery of deleted items across Windows, Linux, Mac, and RAM/memory forensics.
• Analyze network and operating system log files, including Windows Event logs, Unified Audit Logs, firewall logs, and VPN logs.
• Work with the Security Operations Center (SOC) to use data from EDR alerts to identify Indicators of Compromise (IOCs) or Tactics, Techniques, and Procedures (TTPs) for variants related to the case.
• Prepare internal forensic findings and updates in a clear, concise narrative timeline of events, adapted to the call's audience and technical capabilities.
• Use incident-mapping frameworks such as MITRE ATT&CK and Lockheed Martin's Cyber Kill Chain to develop the attack map and contextualize IOCs.
• Review and draft written incident reports, investigative updates, and appendices as directed by counsel and partners, using standard report templates.
• Perform peer reviews of reports written by team members.
• Deliver on the forensic investigations plan and work with the lead to manage timeline, delivery, and execution of forensic analysis across projects.
• Perform other duties as assigned by management.

What you'll need

• Bachelor's degree in Information Security, Computer Science, Digital Forensics, Cyber Security or a related field and 4+ years of incident response or digital forensics experience, or a Master's or Advanced Degree and 3+ years of related experience.
• Possess two or more of the following certifications: Security+, Network+, SANS GCED, GCIH, GCFE, GCFA, CEH, CHFI, EnCE.
• Thorough knowledge of Windows disk, Unix or Linux disk, and memory forensics.
• Knowledge of Network Security Monitoring (NSM), network traffic analysis, and log analysis.
• Experience and understanding of enterprise security controls.
• Experience with EnCase, Axiom, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, WireShark, TCPDump, and open-source forensic tools.
• Ability to establish priorities, work independently, and proceed with objectives with minimal supervision.
• Strong problem-solving and critical-thinking skills to identify and resolve compliance-related issues effectively.
• Excellent verbal and written communication skills to prepare clear, concise reports and collaborate with cross-functional teams.
• Proficient in Microsoft Suite products.

Nice to have

• Experience delivering technical findings to a non-technical audience.
• Experience leading teams of analysts.
• Provide findings in a confident, factual manner.
• Knowledge and experience handling PII, PHI, sensitive, confidential, and proprietary datasets.
• Experience with cyber insurance investigations.

Details

• Location: Hyderabad, India.
• Usual office working conditions.
• Travel within or outside of the state.
• Exempt from the overtime provisions of the Fair Labor Standards Act.