Manager, Digital Forensics Investigator

Optum Philippines; Muntinlupa; On-site; PHP 2,800,000 - 3,600,000; Full time

Job summary

Optum Philippines is seeking a Principal Digital Forensics Investigator in the Cyber Defense group. You will establish, mature, and lead enterprise digital forensics capabilities and provide advanced forensic expertise across endpoints, networks, cloud, and identity systems.

You will drive investigations from evidence collection through analysis and reporting, partner with Incident Response and Cyber Threat Intelligence, and guide security improvements with defensible findings.

Qualifications

• 8+ years of experience in cybersecurity, digital forensics, incident response, or related discipline.
• Demonstrated ability to independently lead complex digital forensic investigations from evidence collection to reporting.
• Strong hands-on experience with endpoint, network, cloud, identity, and mobile forensics.
• Experience developing or improving forensic processes, workflows, and chain-of-custody practices.

Responsibilities

• Establish and lead the Digital Forensics and Investigations capability within Cyber Defense.
• Lead complex digital forensic investigations across endpoint, network, cloud, and identity environments.
• Support incident response lifecycle including scoping, containment, eradication, and post-incident improvements.
• Prepare defensible investigative reports, timelines, and executive summaries for stakeholders.
• Collaborate with Legal, Privacy, HR, Compliance, and other teams to ensure evidence integrity.

Skills

Digital Forensics

Incident Response

Lead Investigations

Forensic Analysis

Education

Bachelor’s degree in Cybersecurity/Computer Science

Tools

SIEM

EDR

Forensic Tools

Job description

Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, and data they need to feel their best. Here, you will find a culture guided by diversity and inclusion, talented peers, comprehensive benefits, and career development opportunities. Come make an impact on the communities we serve as you help us advance health equity on a global scale. Join us to start Caring. Connecting. Growing together.

Position Summary

As a Principal Digital Forensics Investigator within Cyber Defense at Optum Insight, you will serve as the senior technical expert responsible for establishing, maturing, and leading the enterprise digital forensics capability. This role provides advanced forensic expertise in support of cybersecurity incident response, cyber threat intelligence, internal investigations, security investigations, insider-risk matters, and other high-priority events across the organization. You will lead complex forensic investigations across endpoint, network, cloud, identity, application, mobile, and enterprise technology environments; ensure evidence is collected, preserved, analyzed, documented, and handled with forensic integrity; and translate findings into defensible conclusions, containment guidance, detection opportunities, and security improvements. This position partners closely with Security Operations, Incident Response, Data Protection & Insider Risk, Cyber Threat Intelligence, Legal, Privacy, Human Resources, Compliance, and other stakeholders to deliver timely, technically rigorous, and business-aligned investigative outcomes.

Primary Responsibilities

• Establish, mature, and lead the Digital Forensics and Investigations capability within Cyber Defense, including forensic readiness, operating procedures, evidence-handling standards, investigative workflows, playbooks, documentation templates, and quality assurance practices.
• Lead complex digital forensic investigations involving suspected compromise, malware activity, unauthorized access, insider activity, data loss, policy violations, identity misuse, cloud compromise, and other security events requiring defensible digital evidence.
• Provide advanced forensic expertise throughout the incident response lifecycle, supporting scoping, containment, eradication, recovery, root-cause analysis, impact assessment, attacker activity reconstruction, and post-incident improvement efforts.
• Conduct forensic examinations across Windows, Linux, macOS, mobile devices, network infrastructure, cloud platforms, SaaS environments, identity systems, applications, servers, virtual machines, containers, and other enterprise technology assets.
• Develop and execute secure remote evidence collection and preservation processes across distributed environments, including forensic imaging, memory acquisition, log collection, targeted file acquisition, cloud evidence collection, mobile evidence acquisition, hashing, chain of custody, and secure evidence storage.
• Reconstruct timelines and correlate forensic evidence across endpoint, network, cloud, identity, and application telemetry to determine root cause, identify affected assets and accounts, establish attacker or user activity, and support investigative conclusions.
• Support authorized internal investigations involving suspected misuse of technology, unauthorized access, data loss, policy violations, insider activity, and other matters requiring digital evidence, while maintaining confidentiality, privacy requirements, and evidence integrity.
• Partner with Cyber Threat Intelligence and Incident Response teams to translate forensic findings into indicators, adversary behaviors, detection logic, hunting hypotheses, security control improvements, and lessons learned.
• Identify forensic telemetry, tooling, process, and data source gaps; recommend improvements; and develop automation or repeatable workflows for triage, evidence collection, analysis, preservation, and reporting.
• Evaluate, recommend, and operationalize forensic tools, technologies, collection methods, and investigative capabilities across endpoint, network, cloud, identity, and mobile environments.
• Serve as the senior forensic escalation point and trusted technical authority for complex investigations, providing mentorship, investigative standards, peer review, and technical guidance to Cyber Defense teams.
• Prepare clear, technically defensible investigative reports, executive summaries, evidence narratives, timelines, risk implications, and recommended actions for technical teams, senior leadership, Legal, Privacy, HR, Compliance, and other authorized stakeholders.
• Use enterprise-approved automation and AI-enabled capabilities, where appropriate, to improve forensic triage, evidence processing, analysis consistency, reporting efficiency, and continuous improvement.

Required Qualifications

• 8+ years of experience in cybersecurity, digital forensics, incident response, security investigations, or a closely related technical security discipline.
• Demonstrated experience independently leading complex digital forensic investigations from evidence identification and collection through analysis, documentation, final findings, and stakeholder communication.
• Strong hands-on experience with endpoint, network, cloud, identity, and mobile forensic investigations in enterprise environments.
• Experience developing or improving forensic processes, investigative workflows, evidence-handling procedures, chain-of-custody practices, forensic readiness capabilities, or related operational standards.
• Experience with remote evidence collection and preservation, including forensic imaging, memory acquisition, log collection, targeted file collection, cloud evidence collection, hashing, evidence validation, and secure storage.
• Strong understanding of forensic methodologies, evidence integrity, investigative documentation, root-cause analysis, attack reconstruction, and timeline development.
• Experience analyzing Windows and Linux environments; macOS experience strongly preferred.
• Experience investigating cloud platforms, SaaS environments, identity systems, virtual infrastructure, containers, or cloud-hosted workloads.
• Strong understanding of networking, authentication, identity and access management, operating systems, file systems, endpoint detection and response, SIEM telemetry, network security, and enterprise security architecture.
• Demonstrated ability to partner effectively with Incident Response, Cyber Threat Intelligence, Legal, Privacy, HR, Compliance, and other stakeholders.
• Bachelor’s degree in Cybersecurity, Computer Science, Digital Forensics, Information Technology, Criminal Justice, or a related field, or equivalent professional experience.
• Excellent written and verbal communication skills, with the ability to translate highly technical forensic findings into clear, actionable conclusions for technical and non-technical audiences.

Preferred Qualifications

• Professional digital forensics, incident response, or network forensics certifications such as GCFE, GCFA, GNFA, GCIH, EnCE, CFCE, CHFI, or equivalent.
• Experience establishing, scaling, or maturing an enterprise digital forensics, incident response, insider-risk, or technical investigations program.
• Experience supporting legal, HR, privacy, compliance, regulatory, eDiscovery, insider-risk, or employee investigations involving digital evidence.
• Experience with enterprise forensic, EDR, SIEM, SOAR, network security, cloud security, identity, data protection, and evidence management platforms.
• Experience with scripting or automation using Python, PowerShell, Bash, APIs, SOAR workflows, or other methods to support evidence collection, forensic triage, analysis, and reporting.
• Experience conducting or supporting malware, intrusion, data exfiltration, business email compromise, cloud compromise, privileged account misuse, or insider-threat investigations.
• Experience developing executive-level investigative summaries, defensible reports, evidence narratives, timelines, and recommendations for senior leadership and cross-functional stakeholders.
• Experience in healthcare or another highly regulated industry.
• Hands-on experience using enterprise-approved AI-assisted or automation-enabled tools to improve forensic triage, log analysis, evidence processing, or investigative efficiency.