Hybrid DFIR Lead Analyst - Digital Forensics

Gartner, Inc.; Irving (TX); Hybrid; USD 94,000 - 134,000; Full time

Benefits offered by this job

PTO with holidays

401k match up to $7,200 per year

Stock purchase plan at a discount

Job summary

Gartner, Inc. in Irving, TX (and Stamford, CT) seeks a Lead Digital Forensics & Incident Response Analyst to head complex investigations, perform endpoint and cloud forensics, and develop DFIR playbooks.

You will collaborate across Security Operations, Legal, Privacy, and Compliance teams to protect Gartner’s data and systems. The role requires 7+ years in DFIR with leadership experience, strong scripting skills, and deep tooling knowledge.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics or related field.
• 7+ years in digital forensics and incident response; 2+ years in senior/lead capacity.
• Experience using Python, PowerShell or similar scripting languages to automate workflows.
• Hands-on with digital forensics tools: Magnet Forensics, EnCase, Volatility, FTK, KAPE, Velociraptor.
• Cloud forensics in AWS and Azure including Kubernetes/container workloads.
• Strong memory forensics across Windows, macOS, Linux.
• Excellent written/verbal communication for reports to stakeholders.

Responsibilities

• Lead digital forensic investigations involving cybersecurity incidents, insider threats, and regulatory inquiries.
• Conduct forensic acquisition/analysis of endpoints, cloud workloads, network artifacts, logs.
• Develop and maintain DFIR playbooks and SOPs with evidentiary standards.
• Perform advanced log analysis to establish timelines and root cause.
• Develop automation to improve investigative efficiency and evidence collection.
• Mentor junior investigators and mature Gartner's DFIR program.
• Produce clear forensic reports for internal stakeholders and legal teams.

Skills

Digital forensics

Incident response

Python

PowerShell

Forensics tooling

Threat analysis

Education

Bachelor's in CS/Cybersecurity/Digital Forensics

Tools

Magnet Forensics

EnCase

Volatility

FTK

KAPE

Velociraptor

Job description

Gartner, Inc. in Irving, TX (and Stamford, CT) seeks a Lead Digital Forensics & Incident Response Analyst to head complex investigations, perform endpoint and cloud forensics, and develop DFIR playbooks.

You will collaborate across Security Operations, Legal, Privacy, and Compliance teams to protect Gartner’s data and systems. The role requires 7+ years in DFIR with leadership experience, strong scripting skills, and deep tooling knowledge.