DFIR Investigator: Cloud Incident Response & Forensics

Cye; United States; On-site; USD 65,000 - 110,000; Full time

Job summary

Cye's DFIR team is expanding, inviting hands-on security researchers to join frontline investigations and incident response. You will be solving complex cyber incidents for clients, with emphasis on rapid detection, containment, and recovery across cloud and on-premises environments.

As a DFIR teammate, you will conduct cloud-focused forensics in Azure and AWS, investigate Windows and Linux systems, study TTPs and IoCs, and perform proactive threat hunting.

Qualifications

• 1-2 years of experience as a DFIR team member.
• Experience with digital forensics in cloud environments.
• Forensics across Windows and/or Linux, plus network forensics.
• Strong understanding of threat hunting models and cyber threat intelligence (TTPs & IoCs).
• Experience researching large databases using Splunk, Elasticsearch, SQL, or VQL.
• Excellent written and verbal English communication.

Responsibilities

• Perform incident response lifecycle activities: detection, containment, eradication, and recovery.
• Perform incident response in a cloud environment (Azure, AWS etc.).
• Perform digital forensics investigations.
• Research and analyze tactics, techniques, and procedures (TTPs) used by malicious actors.
• Perform hunt-evil and find-evil activities for proactively detecting attacks.
• Work closely with our in-house red team, CTI, and cyber architect teams.
• Work closely with worldwide companies, CISOs, and technology experts.

Skills

Incident response

Digital forensics

Threat hunting

Cloud forensics

Windows/Linux forensics

English communication

Tools

Splunk

Elasticsearch

SQL

VQL

Job description

Cye's DFIR team is expanding, inviting hands-on security researchers to join frontline investigations and incident response. You will be solving complex cyber incidents for clients, with emphasis on rapid detection, containment, and recovery across cloud and on-premises environments.

As a DFIR teammate, you will conduct cloud-focused forensics in Azure and AWS, investigate Windows and Linux systems, study TTPs and IoCs, and perform proactive threat hunting.