Associate -DFIR

eSec Forte Technologies; Gurugram District; On-site; INR 650,000 - 1,200,000; Full time

Benefits offered by this job

Health insurance for employee and deps

Certification reimbursement (e.g., GCI

Annual learning & skill-development

Sponsored conference / training

Flexible work arrangements

Job summary

eSec Forte in Gurugram is seeking a Digital Forensics Analyst to conduct forensic investigations, acquire and analyze evidence, and support incident response. You will work hands-on with industry tools to uncover indicators of compromise and determine root causes.

The role emphasizes maintaining chain of custody, documenting findings, and collaborating with security teams to improve detection and remediation.

Qualifications

• 1–3 years of practical experience in digital forensics or incident response.
• Any graduate degree suffices for education.
• Hands-on experience with EnCase, FTK and AXIOM is required.
• Strong understanding of OS internals (Windows, Linux, macOS) and file systems relevant to forensics.

Responsibilities

• Perform forensic acquisition of digital evidence from endpoints, servers, and mobile devices with chain of custody.
• Use EnCase, FTK, and AXIOM to extract and analyze data for artifacts and malicious activity.
• Support incident response by analyzing incidents, identifying attack vectors, and assisting containment.
• Document forensic findings and timelines in clear, concise reports for internal and client stakeholders.
• Maintain chain of custody and evidence integrity for admissibility.
• Assist in malware triage and contribute to deeper investigations and threat intelligence.
• Collaborate with security ops and threat intel teams to improve detection and response playbooks.

Skills

Digital forensics

Incident response

Forensic tooling

Education

Any graduate degree

Tools

OpenText EnCase

AccessData FTK

Magnet AXIOM

Job description

About the Role

This role focuses on conducting digital forensic investigations, acquiring and analyzing digital evidence, and supporting cyber incident response activities. You will work hands-on with specialized tools to uncover indicators of compromise, determine root causes of security incidents, and contribute to actionable remediation strategies for our diverse client base.

Key Responsibilities

• Perform forensic acquisition of digital evidence from a variety of sources, including endpoints, servers, and mobile devices, ensuring adherence to established methodologies and chain of custody protocols.
• Utilize forensic analysis platforms such as OpenText EnCase, AccessData FTK, and Magnet AXIOM to extract, parse, and analyze data for artifacts, evidence of malicious activity, and user actions.
• Support active incident response engagements by analyzing security incidents, identifying attack vectors, determining scope and impact, and assisting with containment and eradication efforts.
• Document forensic findings, analysis methodologies, and incident timelines in clear, concise technical reports for internal teams and client stakeholders.
• Maintain the integrity and strict chain of custody for all digital evidence collected and analyzed, ensuring its admissibility and defensibility.
• Assist in initial malware triage and analysis to understand basic functionality and impact, contributing to deeper investigations and threat intelligence.
• Collaborate with security operations and threat intelligence teams to integrate forensic findings, enhance detection capabilities, and refine incident response playbooks.

Requirements

• 1-3 years of practical experience in digital forensics or incident response.
• Any graduate degree.
• Demonstrated hands-on experience with forensic tools including OpenText EnCase, AccessData FTK, and Magnet AXIOM.
• Understanding of operating system internals (Windows, Linux, macOS) and file systems relevant to digital forensics.
• Ability to articulate technical findings clearly, both verbally and in written reports.
• Work Mode: onsite
• Location: Gurugram

Nice-to-Have

• Experience with iOS/Android mobile device data extraction and analysis.
• Foundational knowledge or practical experience in static or dynamic malware analysis.
• Familiarity with scripting languages (e.g., Python, PowerShell) for forensic automation or data manipulation.
• Understanding of common attack techniques, threat actor methodologies, and MITRE ATT&CK framework.

Benefits

• Health insurance for the employee and dependents
• Professional security-certification reimbursement (e.g., GCIH, GCFA)
• Annual learning and skill-development allowance
• Sponsored conference / training attendance
• Flexible work arrangements