Senior Digital Forensics Incident Response Analyst

• Investigates security incidents for clients by performing host, disk, memory, network, cloud, and mobile forensics
• Conducts detailed artifact analysis across Windows, Linux, and macOS systems and reconstructs event timelines using disk images, memory captures, network data, and cloud logs
• Guides clients through containment, eradication, and recovery activities, providing clear technical recommendations and communications
• Acts as a senior escalation point for complex incidents and supports the development and mentoring of junior analysts
• Participates in an on‑call rotation to support urgent, time‑sensitive incident response needs
• Completes internal and client project work such as tabletop exercises, IR readiness engagements, environment hardening reviews, and forensic assessments
• Identifies gaps and weaknesses in client environments and provides recommendations to reduce risk and strengthen posture
• Produces accurate, concise documentation, including investigation notes, status communications, and final reports
• Collaborates with global DFIR and cyber defense teams and maintains awareness of current threats, tactics, and forensic methodologies

• Bachelor’s degree or equivalent in Information Technology, Computer Science, Cybersecurity, or a related discipline (preferred)
• Relevant GIAC or equivalent certifications such as: GSEC – Security Essentials GCIA – Certified Intrusion Analyst GCIH – Certified Incident Handler
• Significant hands‑on experience in digital forensics and incident response across host, disk, memory, network, cloud, and mobile environments
• Advanced experience using SIEM, EDR, IDS/IPS, packet analysis utilities, and forensic toolsets in active investigations
• Advanced ability to analyze network traffic using tools such as Wireshark or tcpdump to distinguish normal and malicious behavior
• Experience working in cybersecurity consulting, DFIR services, or equivalent technical security roles
• Minimum of 5 years of experience in the technology information security industry

Additional DFIR‑related certifications are considered a plus