Digital Forensic Analyst - Incident Response & Cloud

OpenTalent; Washington; On-site; USD 90,000 - 130,000; Full time

Job summary

OpenTalent in Washington state seeks a seasoned digital forensics expert to perform examinations of hard drives, mobile devices, servers, network devices, VMs, and cloud environments, ensuring evidence integrity and admissibility.

You will lead forensic acquisitions with write-blocking and hashing, analyze artifacts, conduct memory forensics, log correlation, malware and network analysis, and support e-discovery and IR.

Responsibilities

• Conduct comprehensive digital forensic examinations of hard drives, mobile devices, servers, networks, VMs, and cloud environments for evidentiary artifacts.
• Perform forensic acquisition with write-blocking, hashing, and chain-of-custody procedures to ensure integrity.
• Analyze images for artifacts such as deleted files, metadata, logs, browser history, emails, and user activity records.
• Conduct memory forensics to identify volatile artifacts and running processes.
• Perform log analysis and correlation across endpoints, networks, apps, and cloud platforms to reconstruct timelines and IOCs.
• Perform static and dynamic malware analysis to identify capabilities and indicators of compromise.
• Analyze network captures (PCAPs) and flows to detect malicious activity and exfiltration.
• Conduct mobile forensics (logical/physical) on iOS and Android devices.
• Perform cloud forensics across enterprise cloud environments, including audit logs and IAM records.
• Support e-discovery and litigation holds for electronic data in compliance with legal requirements.
• Serve as the forensics SME within the incident response team across all phases from detection to post-incident review.
• Respond to cybersecurity incidents requiring forensic investigations, preserving volatile and non-volatile evidence.

Job description

OpenTalent in Washington state seeks a seasoned digital forensics expert to perform examinations of hard drives, mobile devices, servers, network devices, VMs, and cloud environments, ensuring evidence integrity and admissibility.

You will lead forensic acquisitions with write-blocking and hashing, analyze artifacts, conduct memory forensics, log correlation, malware and network analysis, and support e-discovery and IR.