DFIR Analyst

What you'll do

• Serve as technical lead on breach response investigations to direct analytical focus and align work with client expectations.
• Conduct EDR-driven incident response and forensic analysis across endpoint, network, cloud, and SaaS environments.
• Develop tactical containment guidance and remediation recommendations tailored to specific attack patterns.
• Acquire and preserve forensic evidence while maintaining strict chain-of-custody procedures and documentation standards.
• Produce high-quality investigative reports and status updates for customers, legal counsel, and other stakeholders.
• Mentor junior analysts on technical methodology, evidence handling, and investigation best practices.
• Develop scripts and tools to automate recurring forensic analysis and reporting workflows.
• Manage triage and analysis during high-pressure, large-scale incidents while maintaining clear decision-making.

What we're looking for

• Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science, or a related technical field (or equivalent practical self-study).
• 4+ years of hands-on experience in digital forensics, incident response, or threat hunting.
• Demonstrated experience serving as a lead or technical contributor on complex breach response engagements.
• Expert-level experience with forensic investigative tools such as X-Ways Forensics, Axiom, and FTK.
• Strong experience with EDR/XDR platforms (SentinelOne preferred) and SIEMs.
• Working knowledge of cloud incident response methodology across at least one major provider (AWS, Azure, or GCP).
• Experience conducting dynamic malware analysis and a solid understanding of the reverse engineering process.
• Scripting ability (Python preferred) to automate investigative or analysis tasks.