Senior Incident Response & Digital Forensics Lead

Check Point Software Technologies; Manila; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

Check Point Software Technologies is seeking an experienced Senior Incident Response and Digital Forensics professional to lead end-to-end investigations across global engagements. You will scope, contain, analyze, and report on complex compromises, reconstruct attacker activity, and drive remediation with cross-functional teams.

The role requires strong DFIR expertise, Windows forensic analysis, and the ability to communicate findings clearly to customers and stakeholders.

Qualifications

• 7+ years of cybersecurity experience.
• Minimum 4 years of hands-on DFIR/Incident Response experience investigating confirmed system or enterprise compromises.
• Demonstrated experience conducting forensic investigations to determine initial access, root cause, attacker activity, persistence, lateral movement, scope and impact.
• Hands-on experience analyzing Windows forensic artifacts, endpoint telemetry, event logs, authentication activity, and network evidence.
• Experience responding to complex incidents such as ransomware, identity compromise, malware infections, and enterprise intrusions.
• Ability to independently scope and drive an investigation and develop defensible remediation recommendations.
• Strong experience producing customer-facing incident reports and presenting technical findings clearly.
• Experience developing incident response plans and playbooks.
• Strong analytical, troubleshooting, and communication skills.
• Ability to work effectively during high-severity incidents requiring coordination across multiple teams and geographies.
• Ability to participate in an on-call rotation, including at least one weekend per month.
• Domestic and international travel may be required.

Responsibilities

• Lead and perform end-to-end Incident Response and Digital Forensics investigations, from scoping to containment, investigation, remediation, and final reporting.
• Perform forensic analysis of compromised systems to determine initial access, root cause, attacker activity, persistence, lateral movement, scope and impact.
• Analyze telemetry to reconstruct attacker activity and indicators of compromise.
• Lead response during complex, large-scale, global security incidents.
• Develop containment, eradication, recovery, and remediation recommendations.
• Produce detailed incident investigation reports documenting attack vectors and actions.

Skills

Cybersecurity

DFIR

Incident Response

Forensics

Communication

Job description

Check Point Software Technologies is seeking an experienced Senior Incident Response and Digital Forensics professional to lead end-to-end investigations across global engagements. You will scope, contain, analyze, and report on complex compromises, reconstruct attacker activity, and drive remediation with cross-functional teams.

The role requires strong DFIR expertise, Windows forensic analysis, and the ability to communicate findings clearly to customers and stakeholders.