Lead DFIR Analyst – 24/7 Incident Response

Socket.dev; United States; On-site; USD 108,000 - 120,000; Full time

Benefits offered by this job

RSUs

ESPP

Flexible time off

Paid holidays

Health insurance

401(k) match

Home office allowance

Job summary

SentinelOne is seeking a DFIR Analyst to lead breach response investigations for a 24x7x365 team. You will own evidence and documentation quality end-to-end, partner with the Engagement Manager on scoping and communications, and bring depth across endpoint, network, and cloud forensics.

Ideal candidates have 4+ years in digital forensics, incident response, or threat hunting, and strong scripting abilities.

Qualifications

• Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science or equivalent.
• 4+ years of hands-on experience in digital forensics, incident response or threat hunting.
• Experience leading breach response engagements and working independently.
• Comfort analyzing Windows, Linux, and macOS environments.
• Expert-level with forensic tools such as X-Ways Forensics, Axiom, FTK.

Responsibilities

• Serve as technical lead on DFIR engagements and align work with client expectations.
• Support case intake, gather technical details, and assess scope.
• Conduct EDR-driven incident response and cloud/network/endpoint forensics.
• Develop containment guidance and remediation recommendations.
• Acquire and preserve forensic evidence following chain-of-custody.
• Prepare interim updates and final investigative reports for stakeholders.
• Lead case handovers, mentor junior analysts, and manage high-pressure incidents.
• Build scripts and tooling to streamline forensic workflows.

Skills

Digital forensics

Incident response

Threat hunting

Python scripting

Evidence handling

Education

Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science

Tools

X-Ways Forensics

Axiom

FTK

EDR/XDR platforms

SIEMs

Job description

SentinelOne is seeking a DFIR Analyst to lead breach response investigations for a 24x7x365 team. You will own evidence and documentation quality end-to-end, partner with the Engagement Manager on scoping and communications, and bring depth across endpoint, network, and cloud forensics.

Ideal candidates have 4+ years in digital forensics, incident response, or threat hunting, and strong scripting abilities.