Senior Digital Forensics and Incident Response (DFIR) Consultant

Ransomware Recovery; Ciudad de México; A distancia; MXN 1,117,000 - 1,863,000; Jornada completa

Descripción de la vacante

An established industry player in cybersecurity is seeking a skilled digital forensics expert to join their dynamic team. This role involves engaging in incident response tasks, collaborating with insurance partners and technical teams, and utilizing advanced tools to analyze and mitigate cyber threats. You will play a critical role in helping clients recover from cyber-attacks, ensuring they can swiftly return to business. The ideal candidate will have a strong background in digital forensics and incident response, with the ability to work independently and produce high-quality results under pressure. If you're ready to make a significant impact in a rapidly evolving field, this opportunity is for you.

Formación

• 2+ years of experience in digital forensics or incident response.
• Knowledge of Windows and Unix/Linux operating systems.
• Industry certifications like MCFE, ENCE, ACE are a plus.

Responsabilidades

• Engage in incident response tasks and collaborate with various partners.
• Collect forensic artifacts and analyze logs for suspicious activities.
• Maintain knowledge of emerging threats and provide high-quality deliverables.

Conocimientos

Digital Forensics

Incident Response

Windows Forensics

Malware Analysis

Threat Research

Customer Service

Communication Skills

Educación

Bachelor's Degree in Cybersecurity or related field

Herramientas

EDR / EPP Technologies

SIEM Solutions

E-Discovery Tools

Descripción del empleo

CYPFER is a leading first-responder cybersecurity organization enabling clients to swiftly and effectively return to business following a cyber-attack. As a global market leader in ransomware post-breach remediation and cyber-attack first response, we consistently deliver results that exceed market standards for handling cyber-extortion and ransomware events. Our team collaborates with prominent global insurance carriers, leading law firms, and Fortune 1000 businesses.

Location:

• We would prefer candidates to be located in one of the following:
  • Mexico City

Core Responsibilities:

1. Engage on behalf of CYPFER in incident response tasks, interacting with various insurance partners, legal counsel, incident response units, client executives, and technical teams.
2. Utilize standard tools and methodologies to collect forensic artifacts and images from affected systems.
3. Assist with Windows forensics and triage to assess compromise and investigations.
4. Familiarity with malware analysis tools and methodologies.
5. Apply mitigation strategies and concepts to remediate identified threats.
6. Analyze triage collections/artifacts for indicators of compromise (IOCs) and potentially malicious activity.
7. Review logs from host systems and appliances to identify suspicious activities.
8. Collect forensic disk and memory images from physical and virtual endpoints and servers.
9. Understanding of an incident lifecycle and cyber-kill-chain.
10. Correlate events and build timelines of events.
11. Maintain current knowledge on emerging threats and vulnerabilities.
12. Analyze files for IOCs using various techniques.

Technical Requirements:

1. 2+ years of experience in digital forensics, incident response, or a similar role.
2. Knowledge of Windows and Unix/Linux operating systems.
3. Understanding of the functionality of EDR / EPP technologies.
4. Familiarity with forensic acquisition and analysis of physical and virtual systems.
5. Working knowledge of storage technologies such as RAID, NAS, SAN, Fiber Channel, iSCSI, and NFS.
6. Ability to analyze and interpret logs from various sources.
7. Ability to perform threat research and analyze current threats.
8. Understanding of business email compromise (BEC) cases and investigation techniques.
9. Participate in a rotating on-call schedule; ability to work on weekends and outside normal business hours as needed.
10. This role is remote but requires the ability to travel on short notice to a client site up to 50%. Must maintain flexibility to travel frequently within 24-48 hours' notice for deployments typically 1-2 weeks in duration.

Business Responsibilities:

1. Maintain current knowledge of information security, incident response techniques, emerging threats, and tools.
2. Work independently and produce high-quality deliverables with minimal supervision.
3. Exhibit strong customer service and consulting skills.
4. Adhere to client and internal policies, procedures, and security practices.
5. Maintain detailed notes and draft updates and reports as required.
6. Remain calm, composed, and articulate in tough customer situations.
7. Exhibit excellent relationship management and communication skills.

Preferred Skills:

1. Understand obfuscation techniques used to conceal malicious commands and traffic, and lateral movement strategies employed by threat actors.
2. Familiarity with exfiltration techniques used by threat actors.
3. Knowledge of SIEM and SOAR solutions.
4. Experience with e-discovery tools and methodologies.
5. Proficiency in collecting and analyzing data from mobile devices/cell phones.
6. Industry certifications such as MCFE, ENCE, ACE, GCFA, GCIH, GNFA, GCFE or similar are a plus.

Compensation: Compensation package includes base salary and multiple bonus opportunities.

Cypfer is an equal opportunity employer. If you need accommodation during the interview process or beyond, please let us know. We celebrate our inclusive work environment and welcome applicants from all backgrounds and perspectives.

We thank you for your interest in joining the Cypfer team! While we welcome all applicants, only those selected for an interview will be contacted.