Lead DFIR & Digital Forensics Leader | Incident Response

Forensic Focus; Stamford (CT); Hybrid; USD 140,000 - 210,000; Full time

Job summary

Forensic Focus in Stamford, CT seeks a Lead Security Analyst specializing in Digital Forensics and Incident Response. You will lead investigations, coordinate with legal, HR and security teams, and guide junior analysts while shaping incident response playbooks and defensible forensic reports.

The role requires 7+ years in DFIR, strong scripting, and hands-on experience with Magnet, EnCase, Volatility, FTK, KAPE, Autopsy and Velociraptor, plus cloud forensics across AWS/Azure and EDR/SIEM/SOAR

Qualifications

• Minimum 7+ years in DFIR with senior leadership experience.
• Proficiency in Python/PowerShell scripting.
• Hands-on experience with leading DFIR tools and cloud forensics.

Responsibilities

• Lead digital forensic investigations across cybersecurity incidents, insider threats, HR matters and legal requests.
• Oversee forensic acquisition and analysis of endpoints, cloud workloads, network data and memory.
• Develop playbooks, automation and defensible forensic reports.
• Collaborate with legal, HR and security teams on high-priority investigations.

Skills

Leadership

Scripting (Python/PowerShell)

Tools

Magnet

EnCase

Volatility

FTK

KAPE

Autopsy

Velociraptor

Cloud forensics (AWS/Azure)

EDR/SIEM/SOAR platforms

Job description

Forensic Focus in Stamford, CT seeks a Lead Security Analyst specializing in Digital Forensics and Incident Response. You will lead investigations, coordinate with legal, HR and security teams, and guide junior analysts while shaping incident response playbooks and defensible forensic reports.

The role requires 7+ years in DFIR, strong scripting, and hands-on experience with Magnet, EnCase, Volatility, FTK, KAPE, Autopsy and Velociraptor, plus cloud forensics across AWS/Azure and EDR/SIEM/SOAR