Senior Incident Response & Digital Forensics Analyst

What You’ll Bring
Substantial hands-on experience leading security incident investigations end to end, from initial signal through root-cause analysis and written conclusion.
Strong practical experience with disk and memory forensics across Windows and Linux, including evidence acquisition and analysis.
Demonstrated malware analysis experience, including static and dynamic analysis, safe detonation, and extraction of useful observables for detection and threat hunting.
Strong knowledge of operating-system internals across Windows, Linux, and macOS.
Strong understanding of networking fundamentals, including TCP/IP, DNS, routing, and network evidence analysis.
Deep hands-on experience investigating large datasets using Splunk or a comparable enterprise search and log-analysis platform.
Experience using endpoint and network telemetry to determine attacker behavior and identify additional evidence when existing visibility is insufficient.
Programming or scripting capability in any language; Python is commonly used within the team.
The ability to investigate difficult and unfamiliar problems independently while knowing when to involve others or seek additional expertise.
Strong written and verbal communication skills, including the ability to explain investigative findings and reasoning clearly.

Experience in one or more of the following areas would be beneficial:
Memory-forensics frameworks such as Volatility and structured forensic acquisition tooling.
Reverse engineering beyond behavioral malware analysis.
Cloud forensics across AWS, Azure, or GCP, including snapshot-based acquisition and investigation.
Threat hunting and knowledge of attacker tools, techniques, and procedures used against enterprise environments.
CrowdStrike Falcon, particularly Real Time Response (RTR), for remote artifact and evidence collection.
Humio / LogScale or other large-scale log-analysis platforms.
Endpoint telemetry and EDR technologies such as osquery, Sysmon, Carbon Black, or Tanium.
Network security monitoring technologies such as Zeek, Suricata, Snort, NetWitness, packet capture, or network IDS.
Working with detection engineering teams to translate investigative findings into sustainable detection coverage.
Git, Jira, Jupyter notebooks, or similar development and collaboration tools.
Relevant certifications such as GCFA, GCFE, GREM, or GNFA.
Experience applying mainstream commercial AI platforms to security or analytical workflows.

We look for people who demonstrate:
Curiosity and problem solving — You explore the unknown, ask good questions, seek evidence, and methodically work through difficult problems.
Persistence — You stay engaged when investigations become complex, incomplete, or difficult to resolve.
Candor and humility — You are confident in your expertise while being open about what you do not know, receptive to feedback, and willing to involve others.
Learning agility — You can quickly develop knowledge of unfamiliar technologies, environments, and investigative techniques.
Collaboration and empathy — You work effectively with people from different technical disciplines, cultures, and backgrounds and respect different perspectives.
Knowledge sharing — You actively help others improve through mentoring, documentation, pairing, and practical knowledge transfer.