DFIR Analyst

TISS; Lahore; On-site; PKR 900,000 - 1,500,000; Full time

Job summary

Trillium Information Security Systems (TISS) is seeking a Digital Forensics & Incident Response (DFIR) Analyst with 1–1.5 years of hands-on experience. The role involves compromise assessments, incident response, and cyber investigations across Windows and Linux environments.

The ideal candidate will analyze IOCs, forensic artifacts, and SIEM/EDR data, and contribute to containment, remediation, and root-cause analysis within a security operations team in Pakistan.

Qualifications

• 1–1.5 years hands-on DFIR, compromise assessments or related investigations.
• Strong understanding of Windows OS and forensic artifacts.
• Experience with Linux forensics and investigation techniques.
• Practical experience with SIEM/EDR and security log analysis.
• Knowledge of incident response methodologies and MITRE ATT&CK framework.

Responsibilities

• Conduct compromise assessments and threat hunting across enterprise environments.
• Investigate cybersecurity incidents including malware infections and ransomware.
• Perform digital forensic investigations on Windows and Linux systems.
• Analyze forensic artifacts such as Windows Event Logs, Registry, Prefetch, Amcache, Shimcache.
• Investigate suspicious processes, persistence, privilege escalation, lateral movement and data exfiltration.
• Analyze SIEM/EDR logs and network telemetry to identify malicious activity.
• Support containment, eradication, recovery, and root cause analysis.
• Prepare investigation reports and remediation recommendations.

Skills

DFIR

Incident response

Digital forensics

Threat hunting

MITRE ATT&CK

IOCs

Event log analysis

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

IBM QRadar

Splunk

Microsoft Sentinel

Microsoft Defender for Endpoint

CrowdStrike

Job description

Trillium Information Security Systems (TISS) | Full time

Founded in 2005, Trillium Information Security Systems (TISS) is Pakistan’s first, and largest cybersecurity company. Today, Trillium has gained unrivaled expertise and experience; having delivered complex information assurance solutions to customers, performed specialized information security services, trained thousands of cyber security professionals across the country, and established a comprehensive network of resellers.

Job Description

Job Summary

We are looking for a skilled and motivated Digital Forensics & Incident Response (DFIR) Analyst with 1 - 1.5 Years of hands-on experience in compromise assessments, incident response, digital forensics, and cybersecurity investigations.

The ideal candidate should have practical experience investigating security incidents, analyzing digital evidence, identifying indicators of compromise (IOCs), and conducting investigations across Windows and Linux environments.

Key Responsibilities

• Conduct compromise assessments and threat hunting activities across enterprise environments.
  
• Investigate cybersecurity incidents, including malware infections, ransomware, unauthorized access, and system compromises.
  
• Perform digital forensic investigations of Windows and Linux systems, including evidence collection, preservation, and analysis.
  
• Analyze forensic artifacts such as Windows Event Logs, Registry, Prefetch, Amcache , Shimcache , and other system artifacts.
  
• Investigate suspicious processes, persistence mechanisms, privilege escalation, lateral movement, and potential data exfiltration.
  
• Analyze SIEM and EDR logs, endpoint telemetry, and network traffic to identify malicious activities.
  
• Support incident triage, containment, eradication, recovery, and root cause analysis.
  
• Correlate IOCs and attacker TTPs using the MITRE ATT&CK framework.
  
• Prepare technical investigation reports, compromise assessment findings, and remediation recommendations.
  

Requirements

• 1 - 1.5 years of hands-on experience in DFIR, compromise assessments, incident response , or related cybersecurity investigations.
  
• Strong understanding of Windows operating systems, forensic artifacts, and event log analysis.
  
• Working knowledge of Linux systems and forensic investigation techniques.
  
• Practical experience with SIEM, EDR, and security log analysis.
  
• Understanding of common attack techniques, incident response methodologies, and the MITRE ATT&CK framework.
  
• Knowledge of networking fundamentals, including TCP/IP, DNS, HTTP/HTTPS, and common protocols.
  
• Familiarity with forensic evidence handling, timeline analysis, and chain of custody.
  
• Strong analytical, problem-solving, documentation, and communication skills.
  

Preferred Technical Skills

• SIEM & EDR: IBM QRadar , Splunk, Microsoft Sentinel, Microsoft Defender for Endpoint, CrowdStrike, or similar solutions.
  
• Scripting: Basic knowledge of PowerShell, Python, or Bash.
  

Education & Certifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field. Equivalent practical experience may be considered.
  
• Relevant certifications such as CHFI, eCDFP , or similar will be an advantage.
  

Ideal Candidate

We are looking for someone with practical exposure to real-world investigations, a strong investigative mindset, attention to detail, and the ability to independently perform initial forensic analysis and compromise assessment activities while working effectively within a team.