Cybersecurity Incident Response & Digital Forensics Specialist

Softthink Solutions Inc; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Softthink Solutions is seeking a highly experienced Cybersecurity Incident Response & Digital Forensics Specialist to support time-sensitive investigations within federal IT environments. You will lead rapid triage, forensic analysis, and threat response, analyzing logs across SIEM, EDR, endpoints, networks, and cloud environments.

Ideal candidates have 8+ years in cybersecurity and 5+ years in incident response or forensics, with familiarity in KEV, NIST guidelines, and evidence handling.

Qualifications

• 8+ years of professional experience in cybersecurity, information security, or related technical disciplines.
• 5+ years of hands-on experience in cybersecurity incident response, digital forensics, or security investigations.
• Demonstrated experience investigating cybersecurity incidents within enterprise or federal IT environments.
• Strong understanding of vulnerability exploitation, incident response processes, and digital forensic methodologies.
• Experience analyzing SIEM, EDR, endpoint, network, and cloud security logs.
• Working knowledge of Windows and Linux operating systems, security architecture, and common attack techniques.
• Familiarity with the CISA KEV Catalog, NIST SP 800-61, NIST SP 800-86, and federal cybersecurity practices.
• Experience preserving digital evidence and preparing technically defensible investigation reports.
• Strong analytical, troubleshooting, technical documentation, and communication skills.
• Ability to respond to urgent cybersecurity incidents and work within accelerated investigation timelines.

Responsibilities

• Conduct rapid cybersecurity incident triage, forensic investigations, and security assessments to identify potential exploitation, unauthorized access, and system compromise.
• Investigate vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog and assess potential exploitation across enterprise IT environments.
• Analyze endpoint, network, application, authentication, SIEM, EDR, vulnerability scanning, and cloud audit logs to identify suspicious activities and indicators of compromise.
• Perform forensic investigations to identify persistence mechanisms, privilege escalation, lateral movement, command-and-control communications, and potential data exposure.
• Collect, preserve, analyze, and document digital evidence following NIST SP 800-86 and established forensic evidence-handling practices.
• Develop incident response plans and recommend containment, eradication, recovery, and risk mitigation strategies.
• Collaborate with cybersecurity teams, system administrators, cloud engineers, and stakeholders to investigate and resolve security incidents.
• Escalate confirmed or suspected security compromises and provide actionable technical recommendations.
• Prepare forensic investigation reports, incident timelines, technical findings, executive summaries, and remediation recommendations.
• Support rapid incident response activities, including initial incident acknowledgment, forensic triage, daily status updates, and incident closeout documentation.
• Maintain accurate investigation records, evidence logs, chain-of-custody documentation, and supporting technical artifacts.
• Ensure incident response activities align with federal cybersecurity requirements, NIST guidance, and organizational security policies.

Job description

Cybersecurity Incident Response & Digital Forensics Specialist

Work Authorization: US Citizen

Work Location: Remote

Position Overview

We are seeking an experienced Cybersecurity Incident Response & Digital Forensics Specialist to support time-sensitive cybersecurity incident investigations, forensic analysis, and threat response activities within federal IT environments.

The ideal candidate will have hands‑on experience investigating cybersecurity incidents, analyzing security logs, identifying indicators of compromise (IOCs), preserving digital evidence, and recommending effective containment and remediation strategies.

This position requires strong technical expertise in endpoint and network forensics, cloud security monitoring, vulnerability exploitation analysis, and federal cybersecurity standards.

Key Responsibilities

• Conduct rapid cybersecurity incident triage, forensic investigations, and security assessments to identify potential exploitation, unauthorized access, and system compromise.
• Investigate vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog and assess potential exploitation across enterprise IT environments.
• Analyze endpoint, network, application, authentication, SIEM, EDR, vulnerability scanning, and cloud audit logs to identify suspicious activities and indicators of compromise.
• Perform forensic investigations to identify persistence mechanisms, privilege escalation, lateral movement, command-and-control communications, and potential data exposure.
• Collect, preserve, analyze, and document digital evidence following NIST SP 800-86 and established forensic evidence-handling practices.
• Develop incident response plans and recommend containment, eradication, recovery, and risk mitigation strategies.
• Collaborate with cybersecurity teams, system administrators, cloud engineers, and stakeholders to investigate and resolve security incidents.
• Escalate confirmed or suspected security compromises and provide actionable technical recommendations.
• Prepare forensic investigation reports, incident timelines, technical findings, executive summaries, and remediation recommendations.
• Support rapid incident response activities, including initial incident acknowledgment, forensic triage, daily status updates, and incident closeout documentation.
• Maintain accurate investigation records, evidence logs, chain-of-custody documentation, and supporting technical artifacts.
• Ensure incident response activities align with federal cybersecurity requirements, NIST guidance, and organizational security policies.

Required Qualifications

• 8+ years of professional experience in cybersecurity, information security, or related technical disciplines.
• 5+ years of hands‑on experience in cybersecurity incident response, digital forensics, or security investigations.
• Demonstrated experience investigating cybersecurity incidents within enterprise or federal IT environments.
• Strong understanding of vulnerability exploitation, incident response processes, and digital forensic methodologies.
• Experience analyzing SIEM, EDR, endpoint, network, and cloud security logs.
• Working knowledge of Windows and Linux operating systems, security architecture, and common attack techniques.
• Familiarity with the CISA KEV Catalog, NIST SP 800-61, NIST SP 800-86, and federal cybersecurity practices.
• Experience preserving digital evidence and preparing technically defensible investigation reports.
• Strong analytical, troubleshooting, technical documentation, and communication skills.
• Ability to respond to urgent cybersecurity incidents and work within accelerated investigation timelines.

Preferred Qualifications

• Experience supporting federal agencies or government cybersecurity programs.
• Knowledge of NIST SP 800-53, FISMA, FedRAMP, and Risk Management Framework (RMF) requirements.
• Experience with forensic tools and techniques for endpoint, network, and cloud investigations.
• Experience with SIEM platforms such as Splunk or Microsoft Sentinel.
• Experience with EDR platforms such as Microsoft Defender for Endpoint or CrowdStrike Falcon.
• Familiarity with AWS CloudTrail, Azure Monitor, Microsoft Entra ID logs, and cloud security monitoring.
• Experience with threat hunting, malware analysis, incident containment, and post-incident reviews.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent professional experience.

Preferred Certifications (Any One or More):

• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Forensic Examiner (GCFE)
• GIAC Cloud Forensics Responder (GCFR)
• CISSP or other relevant cybersecurity certifications

This is a remote position.