DFIR Investigator: Incident Response & Forensics

Trilliuminfosec; Lahore; On-site; PKR 1,200,000 - 2,400,000; Full time

Job summary

Trillium Information Security Systems (TISS) is seeking a DFIR Analyst to join our Security Consultancy and Forensic team in Lahore. You will conduct compromise assessments, incident investigations, and forensic analysis across Windows and Linux environments, delivering clear technical reports.

The ideal candidate has hands-on DFIR tooling experience (Velociraptor, KAPE, Volatility), strong OS internals knowledge, and the ability to work under pressure on multiple cases with minimal supervision.

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or related field (or equivalent).
• 2 years of hands-on experience in digital forensics and/or incident response.
• Strong understanding of Windows and Linux OS internals, networks, and artifacts.
• Experience using DFIR tools such as Velociraptor, KAPE, EZ Tools, UAC, Log Analysis Tools, Volatility.

Responsibilities

• Conduct compromise assessments to identify intrusions, persistence, lateral movement, privilege escalation, and data exfiltration.
• Conduct digital forensic investigations across Windows and Linux systems.
• Collect, preserve, and analyze digital evidence following forensic best practices.
• Correlate findings with MITRE ATT&CK to identify adversary tactics, techniques, and procedures (TTPs).
• Leverage Threat Intelligence platforms to enrich investigations and validate IOCs.
• Respond to security incidents including ransomware attacks and data breaches.
• Prepare comprehensive forensic and incident reports covering technical findings and remediation recommendations.
• Collaborate with SOC, Threat Hunting, IT, and other teams to contain, eradicate, and recover from incidents.
• Contribute to continuous improvement of DFIR processes, capabilities, methodologies, tools, and playbooks.

Skills

Windows internals

Linux internals

Network protocols

Memory artifacts

DFIR tooling

Education

Bachelor's degree in Computer Science / Cybersecurity / Information Security

Tools

Velociraptor

KAPE

EZ Tools

UAC

Log Analysis

Volatility

Job description

Trillium Information Security Systems (TISS) is seeking a DFIR Analyst to join our Security Consultancy and Forensic team in Lahore. You will conduct compromise assessments, incident investigations, and forensic analysis across Windows and Linux environments, delivering clear technical reports.

The ideal candidate has hands-on DFIR tooling experience (Velociraptor, KAPE, Volatility), strong OS internals knowledge, and the ability to work under pressure on multiple cases with minimal supervision.