Cybersecurity Incident Investigator
Core
Conduct deep-dive, end-to-end cybersecurity investigations into advanced threats (malware, ransomware, BEC, insider threats) across cloud, identity, and hybrid systems to determine root cause and contain incidents.
Role type
Senior IC cybersecurity incident investigator (digital forensics)
Builds
Defensible root-cause determinations and executive-ready investigation reports
Domain
Cybersecurity / Digital Forensics / Cloud Security
Required skills
End-to-end incident response, digital forensics, identity and access architecture (Azure AD, Active Directory), SIEM telemetry analysis, forensic artifact analysis, attack timeline reconstruction, business risk assessment, executive communication
Preferred skills
GIAC GCFE/GCFA/GCIH/GNFA or CISSP, enterprise forensic tooling (Velociraptor, FTK, EnCase, Volatility, KAPE), EDR/XDR platforms, MITRE ATT&CK
Technologies
Microsoft Entra ID, Active Directory, Windows, Linux, SIEM, Velociraptor, FTK, EnCase, Volatility, KAPE
Responsibilities
Investigate advanced threats including malware, ransomware, credential theft, and business email compromise; examine evidence across multiple platforms to determine root cause and initial access vectors; assess business and compliance risks; produce clear, executive-ready investigation reports; brief non-technical stakeholders during high-severity events.
Seniority
Senior, hands-on IC