Digital Forensics Analyst I – Incident Response

Arete; United States; On-site; USD 65,000 - 95,000; Full time

Job summary

Arete is seeking a Forensics Analyst I to support the DFIR team on active projects, performing triage and deep-dive analysis of data from Windows, Mac, Linux, and network devices. You will document findings, develop timelines, and communicate critical IOCs and TTPs to stakeholders.

Work involves collaboration with SOC and Threat Intel, using MITRE ATT&CK and Kill Chain frameworks to contextualize adversary actions and data access events. Travel within or outside the state may be required.

Qualifications

• Associate degree with 4+ years in incident response or digital forensics, or a related Bachelor's degree.
• Certifications such as Security+, GCFE, GCFA, GCSD, GCED or GCHE are preferred.

Responsibilities

• Performs digital forensic analysis on Windows, Mac, and Linux OS and network appliances.
• Documents findings and builds a master timeline and attack map for cases.
• Identifies data sources to collect and fills gaps across the attack lifecycle.
• Collaborates with SOC to extract IOCs and map TTPs for case variants.
• Delivers clear narrative updates and adapts delivery to audience and role.
• Maintains case notes, trackers, timelines, and collaboration artifacts.

Skills

Forensic artifacts

OS forensics

Log analysis

Network logs

Threat intel basics

Writing reports

Education

Associate’s degree / 4+ years IR or Bachelor's in IS / Cyber Security

Tools

EnCase

Axiom

FTK

X-Ways

Volatility

Splunk

Wireshark

TCPDump

Job description

Arete is seeking a Forensics Analyst I to support the DFIR team on active projects, performing triage and deep-dive analysis of data from Windows, Mac, Linux, and network devices. You will document findings, develop timelines, and communicate critical IOCs and TTPs to stakeholders.

Work involves collaboration with SOC and Threat Intel, using MITRE ATT&CK and Kill Chain frameworks to contextualize adversary actions and data access events. Travel within or outside the state may be required.