Lead Digital Forensics Analyst, Incident Response

Arete Advisors LLC; Texas; Hybrid; USD 120,000 - 170,000; Full time

Job summary

Arete Incident Response is seeking a senior Forensics Analyst in Texas to lead investigations into ransomware and compromises. You will analyze OS artifacts across Windows, Linux, and Mac, recover deleted items, and examine RAM forensics.

Collaboration with tiger team analysts and the SOC is essential to identify IOCs and TTPs. You will prepare clear investigations timelines and narrative findings, aligned with MITRE ATT&CK and the Cyber Kill Chain, for counsel and partners.

Qualifications

• Bachelor’s degree in Information Security, Computer Science, Digital Forensics, Cyber Security or related field.
• Possess two or more of the listed certifications (Security+, Network+, SANS GCED, GCIH, GCFE, GCFA, CEH, CHFI, EnCe).
• 4+ years of incident response or digital forensics experience (or 3+ with Master's).
• Strong written and verbal communication for non-technical audiences.

Responsibilities

• Lead forensics analysis on ransomware/compromise engagements.
• Analyze OS artifacts across Windows, Linux, Mac and RAM forensics.
• Review logs (Windows Event, NSM, firewall, VPN) for IOCs/TTPS.
• Draft findings, timelines, and narrative reports for counsel and partners.
• Peer review of colleagues’ reports and deliverables.

Skills

Windows/Linux forensics

Log analysis

NSM

Security controls

Communicate findings

Team leadership

Education

Bachelor’s degree in Information Security / Cyber Security / Digital Forensics

Two or more of: Security+, Network+, SANS GCED, GCIH, GCFE, GCFA, CEH, CHFI, EnCe

Tools

EnCase

Axiom

FTK

X-Ways

SIFT

Splunk

Volatility

WireShark

TCPDump

Job description

Arete Incident Response is seeking a senior Forensics Analyst in Texas to lead investigations into ransomware and compromises. You will analyze OS artifacts across Windows, Linux, and Mac, recover deleted items, and examine RAM forensics.

Collaboration with tiger team analysts and the SOC is essential to identify IOCs and TTPs. You will prepare clear investigations timelines and narrative findings, aligned with MITRE ATT&CK and the Cyber Kill Chain, for counsel and partners.