Cybersecurity Incident Response & Digital Forensics Analyst

Blackfluo.ai; Paris; Sur place; EUR 70 000 - 90 000; Plein temps

Résumé du poste

A cybersecurity firm in Paris is looking for an experienced Cybersecurity Incident Response & Digital Forensics Analyst to lead incident management and conduct forensic investigations. The ideal candidate should have over 6 years of experience, expertise with various forensic tools, and a strong analytical background. You will manage the entire incident lifecycle, ensuring effective response and recovery strategies. This role is essential for maintaining security integrity and enhancing incident response capabilities.

Qualifications

• Proven experience managing complex security incidents.
• Strong analytical skills for reconstructing attack scenarios.
• Knowledge of legal requirements for digital evidence handling.

Responsabilités

• Lead security incident response activities.
• Conduct digital forensic investigations.
• Create comprehensive incident reports.

Connaissances

6+ years experience in cybersecurity incident response

Forensic tools proficiency (EnCase, FTK)

Knowledge of Windows, Linux, macOS forensics

Experience with network forensics

Proficiency in scripting languages (Python, PowerShell)

Formation

Bachelor's degree in Cybersecurity or related field

Outils

EnCase

FTK

Volatility

Autopsy

SIFT

REMnux

Description du poste

Cybersecurity Incident Response & Digital Forensics Analyst

Job Openings Cybersecurity Incident Response & Digital Forensics Analyst

About the job Cybersecurity Incident Response & Digital Forensics Analyst

Cybersecurity Incident Response & Digital Forensics Analyst

Position Overview

We are seeking a Cybersecurity Incident Response & Digital Forensics Analyst to lead security incident management, conduct digital forensic investigations, and manage the complete incident lifecycle including containment, eradication, and recovery while providing expert forensic analysis to determine attack vectors and attribution.

Key Responsibilities

Lead security incident response activities following established IR procedures and frameworks (NIST 800-61)

Perform rapid containment and isolation of compromised systems to prevent lateral movement

Coordinate incident response team activities and communicate with stakeholders during active incidents

Execute eradication procedures to remove threats and implement recovery strategies for affected systems

Conduct post-incident reviews and lessons learned sessions to improve response capabilities

Perform digital forensic analysis on compromised systems, networks, and digital evidence

Conduct disk imaging, memory analysis, and network traffic examination using forensic tools

Analyze malware samples, attack techniques, and tactics, techniques, and procedures (TTPs)

Reconstruct attack timelines and determine initial compromise vectors and attack progression

Preserve evidence integrity and maintain proper chain of custody for legal proceedings

Threat Analysis & Attribution

Analyze threat intelligence and correlate indicators of compromise (IOCs) with ongoing investigations

Conduct threat hunting activities to identify advanced persistent threats and insider threats

Perform behavioral analysis and pattern recognition to identify sophisticated attack campaigns

Document attack methodologies, tools used, and provide attribution assessments

Collaborate with law enforcement and external threat intelligence sources when appropriate

Documentation & Reporting

Create comprehensive incident reports including technical analysis and business impact assessments

Document forensic findings and maintain detailed investigation case files

Prepare executive briefings and technical reports for management and legal teams

Develop and maintain incident response playbooks and forensic investigation procedures

Support legal proceedings by providing expert testimony and forensic evidence analysis

Required Qualifications

Technical Skills

6+ years experience in cybersecurity incident response and digital forensics

Expert proficiency with forensic tools (EnCase, FTK, Volatility, Autopsy, SIFT, REMnux)

Strong knowledge of Windows, Linux, and macOS forensics and system internals

Experience with network forensics, packet analysis, and log correlation techniques

Understanding of malware analysis, reverse engineering, and threat hunting methodologies

Proficiency in scripting languages (Python, PowerShell) for automation and analysis

Proven experience managing complex security incidents from detection through recovery

Strong analytical skills for reconstructing attack scenarios and identifying root causes

Knowledge of legal and regulatory requirements for digital evidence handling

Experience with threat intelligence platforms and indicators of compromise analysis

Understanding of compliance frameworks and breach notification requirements

Preferred Qualifications

Bachelor's degree in Cybersecurity, Computer Science, or related field

Security certifications (GCIH, GCFA, GNFA, CISSP, CISM, CCE)

Experience with cloud forensics (AWS, Azure, GCP) and containerized environment investigations

Background in law enforcement or military cybersecurity operations

Knowledge of threat actor groups, attack frameworks (MITRE ATT&CK), and cyber threat landscape