DFIR Analyst

ARBEIT INFOTECH INC.; Quezon City; On-site; PHP 900,000 - 1,300,000; Full time

Job summary

ARBEIT INFOTECH INC. is seeking a DFIR Analyst to support government agencies in investigating, responding to, and mitigating cybersecurity incidents.

The role covers digital forensics, incident response, threat intelligence, and evidence handling, with on-site duties in Quezon City. The candidate will analyze logs from SIEMs and EDRs, perform forensic imaging, document findings, and contribute to weekly metrics.

Qualifications

• 3+ years of experience in Incident Response and/or Digital Forensics.
• Hands-on experience in incident investigation, malware analysis, log analysis, and evidence handling.
• Familiarity with SIEM, EDR, forensic imaging, and digital investigation tools.
• Knowledge of NIST IR lifecycle and/or SANS methodologies.
• Working knowledge of MITRE ATT&CK.
• Strong understanding of Windows/Linux systems and network security concepts.
• Strong technical writing and incident reporting skills.

Responsibilities

• Triage and investigate security events, alerts, and logs from government systems.
• Investigate, contain, and mitigate cybersecurity incidents in coordination with DFIR teams.

Skills

Incident Response

Digital Forensics

Log Analysis

Threat Intelligence

Windows & Linux

Technical Writing

Tools

SIEM

EDR

Forensic Imaging

Job description

DFIR Analyst (Managed Incident Response Personnel)

Location: Quezon City – On-site
Schedule: Morning Shift, 8:00 AM–5:00 PM

Job Overview

We are looking for a DFIR Analyst to support government agencies in the investigation, response, and mitigation of cybersecurity incidents. The role focuses on Digital Forensics and Incident Response (DFIR), including incident investigation, forensic analysis, threat intelligence, evidence handling, and incident documentation.

Key Responsibilities

• Triage and investigate security events, alerts, and logs from government systems.

• Investigate, contain, and mitigate cybersecurity incidents in coordination with DFIR teams and authorized personnel.

• Analyze and correlate logs from SIEM, cloud, sandbox, and threat intelligence platforms.

• Perform digital forensic acquisition and analysis of disk, memory, and network evidence following established SOPs and evidentiary standards.

• Reconstruct incident timelines and identify user activity, authentication artifacts, malware, execution traces, and persistence mechanisms.

• Identify and analyze Indicators of Compromise (IOCs) and attacker Tactics, Techniques, and Procedures (TTPs) using threat intelligence.

• Prepare clear and accurate incident reports, technical analysis, findings, and recommendations.

• Use enterprise DFIR, endpoint, network, memory, and malware analysis tools.

• Participate in hands-on incident response, digital forensics, and red/blue team exercises.

• Support knowledge transfer and capability-building activities for DFIR personnel.

• Contribute incident metrics and operational data to weekly and monthly reports.

Qualifications

• 3+ years of experience in Incident Response and/or Digital Forensics.

• At least two (2) of the following certifications or equivalent:

  • CCDL1

  • CCDL2

  • CompTIA Security+

  • CompTIA CySA+

  • eCIH

• Hands-on experience in incident investigation, malware analysis, log analysis, and evidence handling.

• Familiarity with SIEM, EDR, forensic imaging, and digital investigation tools.

• Knowledge of NIST Incident Response Lifecycle and/or SANS methodologies.

• Working knowledge of MITRE ATT&CK.

• Strong understanding of Windows/Linux systems, servers, workstations, virtualized environments, and network security concepts.

• Strong technical writing and incident reporting skills.

• Willingness to work on-site in Quezon City and report on weekends when required.

Preferred Skills

• Experience supporting SOC, CERT/CSIRT, MDR, or Managed Incident Response operations.

• Experience with enterprise DFIR platforms and automated investigation workflows.

• Exposure to government, enterprise, or regulated environments.

• Experience handling forensic evidence in accordance with legal or evidentiary requirements.