DFIR Investigator: Cyber Incident Response & Forensics

Minerva Cyber Tech; Columbia (MD); On-site; USD 85,000 - 120,000; Full time

Job summary

Minerva Cyber Technologies seeks a Digital Forensics and Incident Response (DFIR) Analyst to investigate cyber incidents and produce reliable evidence about what happened, what was affected, and what should happen next. You will support incident responders and system owners throughout investigation and recovery.

Responsibilities include collecting endpoint, memory, network, identity, and cloud forensics; preserving evidence integrity; building timelines; and delivering findings and

Qualifications

• Experience conducting digital forensic examinations or hands-on incident investigations.
• Knowledge of operating system artifacts, log analysis, evidence integrity, and investigative limitations.
• Ability to explain analytical methods and distinguish confirmed findings from unresolved questions.
• Experience producing clear reports and working within defined investigative authority.
• Ability to travel to client sites as needed.

Responsibilities

• Collect and examine authorized endpoint, memory, network, identity, and cloud forensic evidence.
• Preserve evidence integrity and maintain investigation notes and chain-of-custody handling records.
• Build forensic timelines and assess persistence, affected accounts, access paths, and potential impact.
• Provide evidence-based input to containment, eradication, and recovery decisions.
• Prepare technical findings, incident summaries, and recommendations for future detection.

Skills

Digital forensics

Incident response

Evidence integrity

Report writing

Travel readiness

Job description

Minerva Cyber Technologies seeks a Digital Forensics and Incident Response (DFIR) Analyst to investigate cyber incidents and produce reliable evidence about what happened, what was affected, and what should happen next. You will support incident responders and system owners throughout investigation and recovery.

Responsibilities include collecting endpoint, memory, network, identity, and cloud forensics; preserving evidence integrity; building timelines; and delivering findings and