DFIR Analyst
Core
Deliver rapid, expert breach response for global enterprises facing active cyber threats through hands-on forensic analysis, threat hunting, and investigative work across live incidents.
Role type
DFIR Analyst (hands-on IC)
Builds
Forensic evidence, investigative reports, and containment actions for endpoint, network, and cloud environments.
Domain
Cybersecurity / Digital Forensics
Deliverable
client delivery
Required skills
EDR-driven incident response, forensic analysis (endpoint/network/cloud/SaaS), malware and memory analysis, evidence acquisition and chain-of-custody, case documentation, scripting/automation, Windows forensic artifacts analysis
Preferred skills
Linux/macOS forensic analysis, cloud environments (AWS/Azure/GCP), reverse engineering, endpoint threat hunting, cyber threat intelligence platforms, MITRE ATT&CK framework, AI-assisted triage tools
Technologies
X-Ways Forensics, Axiom, FTK, SentinelOne EDR/XDR, SIEMs
Responsibilities
Conduct EDR-driven incident response and vendor-agnostic forensic analysis; Support malware and memory analysis tasks; Acquire and preserve forensic evidence following chain-of-custody; Support case intake, containment actions, and security hardening recommendations; Maintain thorough case documentation; Contribute to customer-facing status updates and formal investigative reports; Participate in rotating on-call schedule for weekends and holidays
Seniority
Junior to Mid-level, hands-on IC