Senior Investigator Digital Forensics, Incident Response (DFIR)

What you'll do

• Conduct complex forensic analysis including memory forensics, malware triage, and encrypted artifact recovery.
• Perform host and network digital forensics, log analysis, and threat hunting during active incidents.
• Leverage EDR solutions and cloud platforms to identify attacker Tactics, Techniques, and Procedures (TTPs).
• Develop indicators of compromise and create comprehensive attack timelines for investigations.
• Create automation tools and scripts to improve team efficiency and investigation capabilities.
• Mentor and train junior investigators while providing quality assurance on their findings.
• Lead large workstreams of 20-50+ systems with minimal oversight and strategic direction.
• Author comprehensive client reports with defensible conclusions and present technical findings to stakeholders.

What we're looking for

• Bachelor's degree or equivalent (minimum 12 years work experience).
• Associate’s degree with a minimum of 6 years of work experience.
• Minimum 4 years of Digital Forensics and Incident Response (DFIR) experience with expertise in complex investigations.
• Minimum 3 years of experience in enterprise incident response, digital forensics, and cyber incident investigation processes.
• Proficiency with common DFIR toolsets (Volatility, X-Ways, FTK, EnCase, Autopsy, etc.) and Windows, GNU/Linux, and MacOS operating systems.
• Ability to obtain US security clearances as required by client engagement.
• Experience with Cloud environments (AWS, Azure, GCP) and cloud-native forensics (preferred).
• Experience with OT and ICS environments (preferred).
• Proficiency in scripting and programming languages such as Python, PowerShell, or Bash (preferred).
• Experience with reverse engineering, sandboxing, and advanced malware analysis (preferred).
• Security certifications such as GCFA, GCFE, GREM, GCIH, CEH, or similar (preferred).
• Advanced certifications such as SANS 500-level, OSCP, or OSCE (preferred).