Digital Forensics and Incident Response Specialist

• Direct high-severity incident response lifecycles, including threat hunting, system isolation, and compromise containment across the global network
• Perform digital forensic investigations of volatile host memory dumps, master file tables, system registries, and kernel memory layers
• Reconstruct attack timelines involving persistence methods, command-and-control callback patterns, lateral movement, and data exfiltration
• Preserve digital evidence through chain-of-custody procedures, drive imaging, and network capture collection
• Analyze malware behavior and payload scripts, reverse engineer malicious scripts, unpack obfuscated code, and produce actionable indicators of compromise
• Author forensic investigation runbooks and expert reports covering breach roots, compromised assets, data exposure, and recovery steps
• Collaborate with GRC and legal compliance teams on breach notification requirements and regional privacy laws such as GDPR and HIPAA

• 5 to 8 years of core cybersecurity systems engineering experience
• 4+ dedicated years conducting digital forensics investigations and executing complex incident response
• Mandatory certification: GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH), or Certified Computer Examiner (CCE)
• Strong technical mastery of EnCase, FTK, Volatility, X-Ways Forensics, memory acquisition tools, and packet analysis suites
• Deep understanding of NTFS, EXT4, FAT, operating system log architectures, network packet capture parsing, and malware persistence mechanics
• Preferred: experience with ransomware negotiations or high-stakes ransomware containment events
• Preferred: Python or Perl scripting for custom string-search queries or parsing non-standard database application trace files

• Remote work arrangement