Digital Forensics Analyst

Forensic Focus Limited; Indianapolis (IN); Hybrid; USD 90,000 - 130,000; Full time

Job summary

Forensic Focus Limited seeks an experienced DFIR analyst to lead and support incident response investigations across malware, ransomware, and APTs. The role covers endpoint, memory, disk, and cloud forensics, with proactive threat hunting and adversary emulation via purple team exercises.

You will develop and tune detections within SIEM and EDR platforms while collaborating across red and blue teams in a large, globally recognised organisation. US citizenship is required.

Qualifications

• Experience with memory analysis and malware triage.
• Familiarity with KQL, Sigma rules, YARA, PowerShell, Python.
• Knowledge of the MITRE ATT&CK framework.

Responsibilities

• Lead and support incident response investigations covering malware, ransomware, and APTs.
• Perform endpoint, memory, disk, and cloud forensics.
• Develop and tune detections within SIEM and EDR platforms.

Skills

Incident response

DFIR

Threat hunting

Purple team

Forensic analysis

Tools

Volatility 3

FTK Imager

Velociraptor

Microsoft Sentinel

Splunk

CrowdStrike Falcon

Microsoft Defender XDR

Job description

The Role

The analyst leads and supports incident response investigations covering malware, ransomware, and APTs, while conducting endpoint, memory, disk, and cloud forensics. Responsibilities also include proactive threat hunting, adversary emulation via purple team exercises, and developing and tuning detections within SIEM and EDR platforms.

Skills & Experience

Candidates should have experience with tools such as Volatility 3, FTK Imager, Velociraptor, Microsoft Sentinel, Splunk, CrowdStrike Falcon, and Microsoft Defender XDR. Familiarity with KQL, Sigma rules, YARA, PowerShell, Python, and the MITRE ATT&CK framework is strongly preferred alongside memory analysis and malware triage skills.

Who It Suits

This role suits an experienced DFIR professional who thrives working across red and blue team boundaries, enjoys investigating real-world attacks, and wants to build detection and forensic capabilities within a large, globally recognised engineering organisation. US citizenship is required.