Cybersecurity Incident Response & Digital Forensics Specialist

Jobgether; United States; À distance; USD 55 000 - 69 000; Plein temps

Avantages offerts par ce poste

Fully remote in the United States

Professional development opportunities

Résumé du poste

Jobgether seeks a Cybersecurity Incident Response & Digital Forensics Specialist based in the United States. You will investigate and respond to complex cybersecurity incidents, conduct forensic investigations, and prepare detailed reports. This fully remote role requires U.S.

citizenship and a strong background in incident response and digital forensics across federal and enterprise IT environments. You will analyze SIEM/EDR/logs, preserve evidence per NIST standards, and develop containment

Qualifications

• 8+ years in cybersecurity or related field.
• 5+ years in incident response or forensics.
• Experience investigating incidents in enterprise or federal IT environments.
• Understanding of vulnerability exploitation and incident response methodologies.
• Ability to analyze logs from SIEM/EDR/Cloud services.
• Strong documentation and communication skills.
• U.S. citizenship is required.

Responsabilités

• Conduct rapid cybersecurity incident triage, forensic investigations, and security assessments.
• Investigate KEV Catalog vulnerabilities across enterprise IT environments.
• Analyze SIEM, EDR, endpoint, network, and cloud logs for IOCs.
• Perform digital forensic investigations to uncover persistence and data exposure.
• Preserve digital evidence and document findings per standards (NIST SP 800-86).
• Develop incident response strategies and containment/recovery plans.
• Collaborate with IT teams to investigate, manage, and resolve incidents.
• Escalate incidents with clear technical recommendations.
• Prepare forensic reports, timelines, and executive summaries.
• Support time-sensitive incident response operations and closure documentation.
• Maintain chain-of-custody and investigation records.
• Ensure compliance with federal cybersecurity requirements and policies.

Connaissances

Incident response

Digital forensics

Security investigations

Vulnerability analysis

Technical reporting

Communication skills

Formation

Bachelor's degree in Cybersecurity/Computer Science/Information Technology

GIAC Certifications (GCIH, GCFA, GCFE, GCFR)

Outils

Splunk

Microsoft Sentinel

Defender for Endpoint

CrowdStrike Falcon

Description du poste

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Cybersecurity Incident Response & Digital Forensics Specialist based in the United States.

As a Cybersecurity Incident Response & Digital Forensics Specialist, you will play a critical role in investigating and responding to complex cybersecurity incidents across federal and enterprise IT environments. You will conduct forensic investigations, analyze security events, identify indicators of compromise, and assess potential vulnerability exploitation. Working with advanced security technologies and established federal cybersecurity frameworks, you will help organizations detect, contain, and recover from security threats. You will also be responsible for preserving digital evidence, producing technically accurate investigation reports, and recommending effective remediation strategies. Collaborating with cybersecurity professionals, cloud engineers, system administrators, and other stakeholders, you will contribute to strengthening security operations and reducing organizational risk. This fully remote opportunity offers the chance to apply your technical expertise to high-priority security challenges in a fast-paced, mission-critical environment.

Accountabilities

• Conduct rapid cybersecurity incident triage, forensic investigations, and security assessments to identify exploitation attempts, unauthorized access, and potential system compromises.


• Investigate vulnerabilities identified in the CISA Known Exploited Vulnerabilities (KEV) Catalog and evaluate potential exploitation across enterprise IT environments.


• Analyze endpoint, network, application, authentication, SIEM, EDR, vulnerability scanning, and cloud audit logs to detect suspicious activities and identify indicators of compromise (IOCs).


• Perform digital forensic investigations to uncover persistence mechanisms, privilege escalation, lateral movement, command-and-control communications, and potential data exposure.


• Collect, preserve, examine, and document digital evidence in accordance with NIST SP 800-86 and established forensic evidence-handling practices.


• Develop incident response strategies and recommend appropriate containment, eradication, recovery, and risk mitigation measures.


• Collaborate with cybersecurity teams, system administrators, cloud engineers, and other stakeholders to investigate, manage, and resolve security incidents.


• Escalate confirmed or suspected security compromises and provide clear, actionable technical recommendations.


• Prepare comprehensive forensic investigation reports, incident timelines, technical findings, executive summaries, and remediation recommendations.


• Support time-sensitive incident response operations, including initial incident acknowledgment, forensic triage, daily progress updates, and incident closure documentation.


• Maintain accurate investigation records, evidence inventories, chain-of-custody documentation, and supporting technical artifacts.


• Ensure all incident response and forensic activities comply with applicable federal cybersecurity requirements, NIST guidelines, and organizational security policies.

Requirements

• Minimum of 8 years of professional experience in cybersecurity, information security, or a related technical discipline.


• At least 5 years of hands-on experience in cybersecurity incident response, digital forensics, or security investigations.


• Demonstrated experience investigating cybersecurity incidents within enterprise or federal IT environments.


• Strong understanding of vulnerability exploitation, incident response methodologies, and digital forensic investigation processes.


• Proven experience analyzing SIEM, EDR, endpoint, network, and cloud security logs.


• Working knowledge of Windows and Linux operating systems, security architectures, and common cyberattack techniques.


• Familiarity with the CISA Known Exploited Vulnerabilities (KEV) Catalog, NIST SP 800-61, NIST SP 800-86, and federal cybersecurity practices.


• Experience preserving digital evidence and producing accurate, technically defensible forensic investigation reports.


• Strong analytical, troubleshooting, problem-solving, and technical documentation skills.


• Excellent written and verbal communication skills, with the ability to explain complex technical findings to different audiences.


• Ability to manage urgent cybersecurity incidents, prioritize competing demands, and work effectively within accelerated investigation timelines.


• US citizenship is mandatory for this position.


• A Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related discipline is required, or equivalent professional experience.


• Relevant professional certifications are required. At least one of the following credentials must be held:
  
  
  • GIAC Certified Incident Handler (GCIH).
  
  
  • GIAC Certified Forensic Analyst (GCFA).
  
  
  • GIAC Certified Forensic Examiner (GCFE).
  
  
  • GIAC Cloud Forensics Responder (GCFR).
  
  

Preferred Qualifications

• Previous experience supporting federal agencies or government cybersecurity programs.


• Knowledge of NIST SP 800-53, FISMA, FedRAMP, and Risk Management Framework (RMF) requirements.


• Hands-on experience with forensic tools and techniques for endpoint, network, and cloud investigations.


• Familiarity with SIEM platforms such as Splunk and Microsoft Sentinel.


• Experience using EDR solutions such as Microsoft Defender for Endpoint and CrowdStrike Falcon.


• Knowledge of AWS CloudTrail, Azure Monitor, Microsoft Entra ID logs, and cloud security monitoring practices.


• Experience in threat hunting, malware analysis, incident containment, and post-incident reviews.


• Additional relevant cybersecurity certifications, such as CISSP, are considered an asset.

Benefits

• Competitive hourly compensation ranging from $40 to $50, depending on experience and qualifications.


• Fully remote working arrangement within the United States.


• Full-time employment opportunity.


• Exposure to complex cybersecurity investigations and federal IT security environments.


• Opportunities to work with advanced cybersecurity technologies, forensic tools, and enterprise security platforms.


• Access to challenging projects involving incident response, digital forensics, vulnerability assessment, and cloud security.


• Opportunities for continuous technical development, professional training, and career growth.


• Collaboration with experienced IT and cybersecurity professionals.


• Opportunity to contribute to strengthening cybersecurity resilience and protecting critical IT environments.