DFIR Trainee

eSec Forte Technologies; Gurugram District; On-site; INR 600,000 - 1,200,000; Full time

Benefits offered by this job

Health insurance

Certification reimbursement

Learning allowance

Conference attendance

Flexible work arrangements

Job summary

eSec Forte seeks a junior cybersecurity professional to support digital forensics and incident response engagements from breach identification through comprehensive remediation. You will contribute to evidence acquisition, malware analysis, and timeline reconstruction, working with experienced practitioners to strengthen client security posture against future threats.

You will document procedures and findings, assist in lab setup and configuration, and apply best practices for evidence

Qualifications

• 1 year hands-on cybersecurity operations with exposure to forensic concepts or incident response processes.
• Graduate degree.
• Foundational understanding of OS internals relevant to forensics.
• Basic networking knowledge and traffic analysis.
• Experience with log analysis and event correlation across security devices.

Responsibilities

• Forensic acquisition and imaging of evidence from endpoints, servers, and cloud environments with data integrity and chain of custody.
• Support initial triage and data collection during active breaches for containment.
• Contribute to malware analysis by identifying behavior and IOC extraction.
• Reconstruct detailed timelines by correlating logs from SIEMs and EDRs.
• Document procedures, methodologies, and findings for reports and reviews.
• Apply best practices for digital evidence preservation and integrity validation.
• Utilize tools like MSAB, Oxygen Forensics, or Exterro for in-depth mobile/device forensics.
• Assist in setup and maintenance of forensic lab infrastructure and related hardware.

Skills

Cybersecurity operations

Digital forensics

Incident response

OS internals

Networking basics

Log analysis

Analytical mindset

Technical reporting

Education

Bachelor's degree

Tools

Magnet Forensics

Cellebrite

EnCase

MSAB

Oxygen Forensics

Exterro

CrackBox

Drona Series

FTK

Job description

About the Role

This role involves supporting digital forensics and incident response engagements from initial breach identification through comprehensive remediation. You will contribute to critical cyber-crisis response efforts, focusing on evidence acquisition, malware analysis, and timeline reconstruction. Working closely with experienced practitioners, you will analyze complex breaches, develop actionable insights, and help our clients strengthen their security posture against future threats.

Key Responsibilities

• Perform forensic acquisition and imaging of digital evidence from endpoints, servers, and cloud environments, utilizing tools such as Magnet Forensics, Cellebrite, and OpenText EnCase, ensuring data integrity and chain of custody.
• Support incident response activities by conducting initial triage, data collection, and preliminary analysis during active security breaches, helping to contain and eradicate threats.
• Contribute to malware analysis efforts, identifying malicious code behavior, extracting indicators of compromise (IOCs), and understanding attack methodologies to inform defensive strategies.
• Participate in detailed timeline reconstruction for security incidents, correlating events from various log sources, including SIEMs and EDR platforms, to establish comprehensive sequences of compromise.
• Document forensic procedures, analysis methodologies, and findings thoroughly and accurately to produce comprehensive incident reports and post-incident review documents.
• Learn and apply best practices for digital evidence preservation, handling, and integrity validation, adhering to established forensic standards.
• Utilize specialized tools such as MSAB, Oxygen Forensics, or Exterro for in-depth mobile device and endpoint forensic examinations, extracting crucial data for investigations.
• Assist in the setup, configuration, and maintenance of forensic lab infrastructure, including specialized hardware like CrackBox for password processing or Drona Series for drone forensics, to enhance analytical capabilities.

Requirements

• 1-1 years of hands-on experience in cybersecurity operations, IT support, or a related technical field, with demonstrated exposure to forensic concepts or incident response processes and methodologies.
• Any graduate degree.
• Foundational understanding of operating systems (Windows, Linux, macOS) internals, including process management, memory structures, file systems, and registry analysis, all relevant to digital forensic investigations.
• Basic knowledge of networking protocols (TCP/IP, DNS, HTTP/S) and network traffic analysis, including the ability to interpret packet captures and identify anomalous communication patterns.
• Familiarity with common cybersecurity attack vectors, threat actor tactics, techniques, and procedures (TTPs), and defense mechanisms across enterprise environments.
• Practical experience with log analysis and event correlation from various security devices or systems (e.g., firewalls, EDRs, SIEMs) to identify suspicious activities.
• Demonstrated analytical and problem-solving abilities, with a methodical and detail-oriented approach to investigating technical issues and anomalies.
• Clear, concise, and accurate written and verbal communication skills for technical documentation, evidence presentation, and effective reporting to internal teams and clients.

Nice-to-Have

• Hands-on experience with forensic analysis platforms such as FTK (Forensic Toolkit) for evidence processing and review.
• Basic scripting capabilities in Python or PowerShell for automating repetitive analysis tasks and data parsing.
• Familiarity with cloud security concepts and incident response procedures within AWS, Azure, or GCP environments, including cloud logging and forensics.
• Exposure to threat intelligence platforms and frameworks like MITRE ATT&CK for contextualizing incident data.

Benefits

• Health insurance for the employee and dependents
• Professional security-certification reimbursement (e.g., GCIH, GCFA for Digital Forensics and Incident Response)
• Annual learning and skill-development allowance
• Sponsored conference / training attendance
• Flexible work arrangements