Digital Forensics & Incident Response Analyst

Forensic Focus Limited; Indianapolis (IN); Hybrid; USD 90,000 - 130,000; Full time

Job summary

Forensic Focus Limited seeks an experienced DFIR analyst to lead and support incident response investigations across malware, ransomware, and APTs. The role covers endpoint, memory, disk, and cloud forensics, with proactive threat hunting and adversary emulation via purple team exercises.

You will develop and tune detections within SIEM and EDR platforms while collaborating across red and blue teams in a large, globally recognised organisation. US citizenship is required.

Qualifications

• Experience with memory analysis and malware triage.
• Familiarity with KQL, Sigma rules, YARA, PowerShell, Python.
• Knowledge of the MITRE ATT&CK framework.

Responsibilities

• Lead and support incident response investigations covering malware, ransomware, and APTs.
• Perform endpoint, memory, disk, and cloud forensics.
• Develop and tune detections within SIEM and EDR platforms.

Skills

Incident response

DFIR

Threat hunting

Purple team

Forensic analysis

Tools

Volatility 3

FTK Imager

Velociraptor

Microsoft Sentinel

Splunk

CrowdStrike Falcon

Microsoft Defender XDR

Job description

Forensic Focus Limited seeks an experienced DFIR analyst to lead and support incident response investigations across malware, ransomware, and APTs. The role covers endpoint, memory, disk, and cloud forensics, with proactive threat hunting and adversary emulation via purple team exercises.

You will develop and tune detections within SIEM and EDR platforms while collaborating across red and blue teams in a large, globally recognised organisation. US citizenship is required.