We are seeking a motivated and skilled Digital Forensics & Incident Response (DFIR) Analyst with 1 to 1.5 years of hands-on experience in compromise assessments, incident response, digital forensics, and cybersecurity investigations. The ideal candidate will have practical experience in investigating security incidents, analyzing digital evidence, identifying indicators of compromise (IOCs), and conducting thorough investigations in both Windows and Linux environments.
Key Responsibilities
- Conduct compromise assessments and threat hunting activities across enterprise environments to identify potential security breaches.
- Investigate cybersecurity incidents such as malware infections, ransomware attacks, unauthorized access, and system compromises.
- Perform digital forensic investigations on Windows and Linux systems, including evidence collection, preservation, and detailed analysis.
- Analyze forensic artifacts including Windows Event Logs, Registry, Prefetch, Amcache, Shimcache, and other relevant system data.
- Examine suspicious processes, persistence mechanisms, privilege escalation attempts, lateral movement, and potential data exfiltration activities.
- Analyze SIEM and EDR logs, endpoint telemetry, and network traffic to detect malicious activities and threats.
- Support incident triage, containment, eradication, recovery efforts, and conduct root cause analysis to prevent recurrence.
- Correlate IOCs and attacker tactics, techniques, and procedures (TTPs) using the MITRE ATT&CK framework.
- Prepare comprehensive technical investigation reports, compromise assessment findings, and provide actionable remediation recommendations.
Required Qualifications
- 1 to 1.5 years of hands-on experience in DFIR, compromise assessments, incident response, or related cybersecurity investigations.
- Strong understanding of Windows operating systems, forensic artifacts, and event log analysis.
- Working knowledge of Linux systems and forensic investigation techniques.
- Practical experience with SIEM, EDR, and security log analysis tools.
- Familiarity with common attack techniques, incident response methodologies, and the MITRE ATT&CK framework.
- Basic understanding of networking fundamentals, including TCP/IP, DNS, HTTP/HTTPS, and other common protocols.
- Knowledge of forensic evidence handling, timeline analysis, and maintaining chain of custody.
- Excellent analytical, problem-solving, documentation, and communication skills.
Preferred Qualifications and Technical Skills
- Experience with digital forensics tools such as FTK Imager, KAPE, Autopsy, Eric Zimmerman Tools, Volatility, and Cyber Triage.
- Familiarity with SIEM and EDR platforms like IBM QRadar, Splunk, Microsoft Sentinel, Microsoft Defender for Endpoint, CrowdStrike, or similar solutions.
- Proficiency with investigation tools including Wireshark, Sysinternals Suite, Velociraptor, YARA, and VirusTotal.
- Basic scripting skills in PowerShell, Python, or Bash are advantageous.
Education and Certifications
- Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field is preferred. Equivalent practical experience may also be considered.
- Relevant certifications such as CHFI (Computer Hacking Forensic Investigator), eCDFP (EC-Council Certified Digital Forensics Professional), or similar credentials will be an advantage.
We are looking for a candidate with practical exposure to real-world investigations, a strong investigative mindset, and keen attention to detail. The ideal professional should be capable of independently performing initial forensic analyses and compromise assessments while collaborating effectively within a team environment.