DFIR Analyst: Incident Response & Digital Forensics

Trillium Information Security Systems; Pakistan; On-site; PKR 1,200,000 - 2,400,000; Full time

Job summary

Trillium Information Security Systems is seeking a Digital Forensics & Incident Response (DFIR) Analyst with 1–1.5 years of hands-on experience in compromise assessments, incident response, digital forensics, and cybersecurity investigations.

The ideal candidate will investigate security incidents, analyze digital evidence, identify IOCs, and conduct investigations across Windows and Linux environments, working with SIEM/EDR logs and MITRE ATT&CK to support remediation.

Qualifications

• 1-1.5 years hands-on DFIR, compromise assessments, incident response or related investigations.
• Strong in Windows and Linux forensics with event-log analysis.
• Experience with SIEM/EDR and security log analysis.
• Familiarity with MITRE ATT&CK framework and common attack techniques.
• Basic networking knowledge and evidence handling/chain of custody.
• Analytical mindset, good documentation and communication skills.

Responsibilities

• Conduct compromise assessments and threat hunting across enterprise environments.
• Investigate cybersecurity incidents including malware, ransomware, and unauthorized access.
• Perform digital forensic investigations on Windows and Linux systems.
• Analyze artifacts like Windows Event Logs, Registry, Prefetch, Amcache & Shimcache.
• Examine suspicious processes, persistence, privilege escalation, lateral movement, and data exfiltration.
• Review SIEM/EDR logs, endpoint telemetry, and network traffic for malicious activity.
• Support triage, containment, eradication, and root-cause analysis.
• Correlate IOCs and attacker TTPs using MITRE ATT&CK; prepare reports and remediation recommendations.

Skills

DFIR experience

Incident response

Digital forensics

Threat hunting

Windows forensics

Linux forensics

SIEM/EDR

Event log analysis

MITRE ATT&CK

Networking basics

Education

Bachelor's degree in Cybersecurity/CS/IT

CHFI/eCDFP or similar

Tools

FTK Imager

KAPE

Autopsy

Eric Zimmerman Tools

Volatility

Cyber Triage

IBM QRadar

Splunk

Microsoft Sentinel

Microsoft Defender for Endpoint

CrowdStrike

Wireshark

Sysinternals Suite

Velociraptor

YARA

VirusTotal

Job description

Trillium Information Security Systems is seeking a Digital Forensics & Incident Response (DFIR) Analyst with 1–1.5 years of hands-on experience in compromise assessments, incident response, digital forensics, and cybersecurity investigations.

The ideal candidate will investigate security incidents, analyze digital evidence, identify IOCs, and conduct investigations across Windows and Linux environments, working with SIEM/EDR logs and MITRE ATT&CK to support remediation.