Digitial Forensics and Incident Response (DFIR) Analyst

Frsecure Llc; Edina (MN); Remote; USD 95,000 - 125,000; Full time

Benefits offered by this job

Flexible work

Meaningful work

Mental health support

Professional development

Benefits package

Generous PTO

Job summary

FRSecure is seeking a DFIR Analyst to provide high-quality incident response investigations and guidance across varied security environments. You will lead proactive efforts like tabletop exercises, while handling triage, case work, and client communications to minimize business disruption.

Regular client interactions and ongoing learning opportunities are central to the role, with remote or hybrid options and a focus on delivering accountable security outcomes.

Qualifications

• 3–5 years of information security experience.
• Experience with Active Directory, systems administration, Exchange/ cloud environments.
• 3–5 years presenting information security concepts.
• Certifications: GCIH/GCFA/ECIH preferred.
• Experience in threat hunting and incident handling.
• Experience managing EDR/SIEM technologies.
• Knowledge of firewalls, network logging, and best practices.
• Strong systems administration background in large environments.
• Analytical skills to interpret data and identify trends.
• Ability to explain complex topics to diverse audiences.
• Customer-focused, solution-oriented mindset.
• Data handling capabilities and proficiency with Office suite.

Responsibilities

• Perform forensic review of client systems for artifacts and IOCs.
• Conduct triage, threat hunting, and case management for IR clients.
• Document evidence, findings, and prepare reports.
• Meet with clients during planning and information sharing stages.
• Develop and deliver proactive projects including tabletop exercises.
• Maintain regular client communications on incident response programs.
• Continue education on cyber forensics and attack methodologies.
• Participate in internal meetings and on-call rotations.

Skills

Information security experience

Active Directory

Cloud environments

Security concepts

Certifications (GCIH/GCFA/ECIH)

Threat hunting

EDR/SIEM management

Firewalls & logs

Systems administration

Analytical skills

Communication skills

Customer service

Data handling

Microsoft Office

Tools

EDR

SIEM

Job description

Description

Why choose FRSecure?

We believe information security is fun. We focus on equipping our clients, communities, and employees with knowledge to better protect themselves against risk. Our first core value, we tell the truth, sets a foundation for meaningful relationships and employee growth, ultimately providing the highest quality work in the industry. FRSecure is consistently awarded for outstanding service, industry-leading methodology, organizational growth, and a reputable culture.

FRSecure is comprised of experts on a mission to fix the broken information security industry. We believe that behind every data compromise are people, and everyone deserves to have their data and livelihood protected. We take great pride in what we do and how we do it, and we truly believe we can accomplish our mission. It starts with hiring the right people to help us get there. If this resonates with you,

Benefits and Work Environment

FRSecure is committed to creating a workplace where people can do their best work while staying balanced, supported, and fulfilled. Our culture is rooted in our mission and values, and we believe that flexibility, trust, and wellbeing are essential to long-term success. Here is what you can expect:

• Flexible Work Environment: We empower employees with flexible schedules and remote or hybrid work options.
• Meaningful, Mission-Driven Work: Join a team that is passionate about making a real impact, with opportunities to contribute in a collaborative, values-driven environment.
• Mental Health & Wellbeing Support: Access to an Employee Assistance Program (EAP) and a culture that actively promotes mental wellbeing, open communication, and sustainable work practices.
• Growth & Development: Ongoing learning opportunities and support for professional development to help you grow in your career.
• Comprehensive Benefits Package: Including medical, dental and vision insurance, health savings, flexible savings and dependent care savings account options, life and disability insurance, 401(k) with employer match up to 4%, and pet insurance.
• Generous Time Off: Unlimited paid time off offered to rest and recharge, paid parental leave (6 weeks of 100% regular, straight time weekly pay for non-birthing parents, and 12 weeks of 100% regular, straight time weekly pay for birthing parents), 11 paid holidays, and volunteer time off.

Position Summary

The Digitial Forensics and Incident Response (DFIR) Analyst is responsible for providing support to clients when they have become or suspect they may be the victim of a cyber-attack. This is done by conducting high quality and timely incident response investigations in environments of varying security maturity including identification and containment phases and advising clients regarding recovery and remediation steps to assist them in returning to normal business operations. Our DFIR Analysts have a blend of proactive project responsibilities, such as leading tabletops and plan coaching, as well as triage and case work.

Working Location

This position is available on a full-time remote basis in the following states only: Arizona, Colorado, Florida, Georgia, Idaho, Illinois, Kansas, Kentucky, Massachusetts, Michigan, Minnesota, Montana, North Carolina, Ohio, Pennsylvania, South Dakota, Tennessee, Texas, Washington, and Wisconsin. Candidates based in Minnesota are preferred but not required. Only candidates located in the United States will be considered. Office headquarters and operational business hours are based in Edina, MN (Central Time).

Application Deadline

November 6, 2026

What Your Day Looks Like as an DFIR Analyst

• Performing a forensic review of client systems for artifacts and indicators of compromise (IOCs) to further identify, contain, and eradicate malware and/or malicious intruders
• Conducting triage, threat-hunting, and case management for incident response clients
• Documenting detailed evidence, findings, and create a report output
• Meeting with clients during the planning, information sharing, and technical support stages
• Creating and delivering proactive projects to clients including tabletop exercises, plan coaching, assessments
• Conducting regular calls with clients to consult on incident response programs
• Continue education by researching and investigating developments in cyber forensics/attack methodologies; increase existing skillset to handle these matters
• Attending and participating in regular internal meetings
• Participating in on-call rotation, providing timely and effective support to clients, ensuring adherence to service level agreements (SLAs) and resolving issues within established response and resolution times
• Performing periodic after-hours and weekends on-call work

Working Hours

Standard working hours for this position are between 8:00am-5:00pm in the time zone in which the employee is based, with the expectation that there may be client calls, project/task responsibilities, meetings, or other company obligations in which the employee will need to work outside of these hours, as standard business hours are 8:00am-5:00pm Central Time.

This position also includes on-call responsibilities. On-call duty will be 1 week in duration with the on-call assignment being dependent upon the number of Analysts on the team. During the on-call rotation, the employee will be required to monitor an email inbox for incoming CSIRT requests as well as answer incoming calls to the CSIRT after-hours hotline and perform incident triage duties.

Travel

There is minimal travel associated with this position, typically less than 5-10%. Occasional travel includes conferences or on-site client projects as needed, as well as any team or company activities.

Requirements

What You Bring to the DFIR Analyst

• 3-5 years of information security experience
• 3-5 years of experience with Active Directory, Systems Administration, Exchange Administration, M365 and/or other cloud environments
• 3-5 years of experience in presenting information security concepts
• GCIH, GCFA, ECIH certifications preferred
• Prior experience in threat hunting and/or incident handling
• Prior experience in management of EDR and/or SIEM technologies
• Experience with firewalls and network devices best practices and logging
• Solid understanding of computer systems administration in large environments
• Demonstrated analytical skills to interpret data, identify trends, and ensure accuracy in all deliverables
• Ability to clearly convey complex information to diverse audiences and actively listen to understand needs and provide effective solutions
• Proven customer service skills with a customer-focused mindset, including the ability to build relationships, resolve issues effectively, and deliver a positive, responsive client experience
• Ability to communicate highly technical topics to non-technical people effectively
• Ability to handle and work with large amounts of data
• Proficient with all Microsoft Office Suite products

Salary

FRSecure believes in and operates with equitable hiring practices. The starting salary range for this position is between $95,000-125,000, not including any bonus, incentive commission, or benefits. The range displayed on each job posting reflects the defined salary range for the position across the United States. Within the range, pay offered is determined by a variety of factors that include but are not limited to job-related skills, experience, and relevant education or training.

Commission eligible: No

FLSA Status: Exempt / Non-Exempt (based on hiring state)

Your Recruiter will be able to discuss further details related to commission, bonuses, or other specific salary information related to this position.

Former and Current Employees

To qualify for this position, former employees must be eligible for rehire, and current employees must be in good standing.

Virtual Interview Participation Policy

As part of FRSecure's commitment to transparency, trust, and meaningful human connection, candidates participating in virtual interviews are expected to join with their camera enabled. Visual engagement supports clearer communication, encourages active participation, and helps create a more inclusive and interactive interview experience for both candidates and our hiring team. We understand that there may be situations where camera use is not feasible due to technical, accessibility, bandwidth, or environmental factors. Candidates who anticipate challenges with video participation should notify their Recruiter or hiring contact before the interview so that reasonable accommodations can be considered.

FRSecure is committed to providing an inclusive hiring process and will work with candidates to address accommodation needs whenever possible.

Employment and Application Statements

FRSecure, LLC is committed to the principles of equal employment. We comply with all federal, state, and local laws providing equal employment opportunities, and all other employment laws and regulations. It is our intent to maintain a work environment that is free of harassment, discrimination, or retaliation because of race, color, creed, religion, national origin, sex, sexual orientation (including transgender status, gender identity or expression), pregnancy (including childbirth, lactation, or related conditions), marital status, disability, public assistance, age, and familial status, genetic information, local commissions activity, veteran status, uniformed servicemember status, or any other status protected by federal, state, or local laws.

FRSecure is dedicated to the fulfillment of this policy in regard to all aspects of employment, including but not limited to recruiting, hiring, placement, transfer, training, promotion, rates of pay, and other compensation, termination, and all other terms, conditions, and privileges of employment.

FRSecure is committed to the full inclusion of all qualified individuals. As part of this commitment, FRSecure will ensure that persons with disabilities are provided reasonable accommodations for the hiring process. If a reasonable accommodation is needed to complete a job application, interview, or otherwise participate in the hiring process, please contact the Human Resources team at [e-mail].