Global Incident Response & Digital Forensics Lead

Check Point Software; Manila; On-site; PHP 2,000,000 - 4,500,000; Full time

Job summary

Check Point Software in Makati City, Philippines, seeks a senior Incident Response and DFIR specialist to lead end-to-end investigations across global incidents and to develop robust incident response playbooks.

The role involves analyzing Windows artifacts, telemetry, and network evidence, coordinating across teams, and communicating findings to senior stakeholders. Travel may be required.

Qualifications

• 7+ years of cybersecurity experience.
• Minimum 4 years of hands-on DFIR/Incident Response investigating confirmed compromises.
• Experience conducting forensic investigations to determine initial access, root cause, attacker activity, persistence, lateral movement, scope and impact.
• Hands-on experience analyzing Windows forensic artifacts, endpoint telemetry, event logs, authentication activity, and network evidence.
• Experience responding to complex incidents such as ransomware, identity compromise, malware infections, and enterprise intrusions.
• Ability to independently scope and drive an investigation and develop defensible remediation.
• Strong experience producing customer-facing incident reports and presenting technical findings.

Responsibilities

• Lead and perform end-to-end Incident Response and Digital Forensics investigations, from initial scoping through containment, forensic investigation, remediation, and final reporting.
• Perform forensic analysis of compromised Windows and other enterprise systems to determine initial access, root cause, attacker activity, persistence, lateral movement, scope, and impact.
• Analyze endpoint, operating system, authentication, network, and security telemetry to reconstruct attacker activity and identify indicators of compromise.
• Lead response efforts during complex, large-scale, and global security incidents.
• Develop and implement containment, eradication, recovery, and remediation recommendations.
• Produce detailed incident investigation reports documenting attack vectors, attacker TTPs, findings, impact, and recommended actions.
• Clearly communicate technical findings and incident status to customer technical teams and senior stakeholders.
• Develop and improve incident response plans, procedures, and playbooks.
• Design realistic cyberattack scenarios and facilitate tabletop exercises.
• Build and maintain forensic and malware-analysis lab environments.
• Collaborate with global incident responders, forensic investigators, security researchers, and customer teams.

Skills

Incident response

DFIR investigations

Windows forensics

Telemetry analysis

On-call readiness

Cross-team collaboration

Job description

Check Point Software in Makati City, Philippines, seeks a senior Incident Response and DFIR specialist to lead end-to-end investigations across global incidents and to develop robust incident response playbooks.

The role involves analyzing Windows artifacts, telemetry, and network evidence, coordinating across teams, and communicating findings to senior stakeholders. Travel may be required.