Lead Forensic Analyst – Ransomware Investigations

Arete; Austin (TX); On-site; USD 120,000 - 180,000; Full time

Job summary

Arete is seeking a seasoned Forensics Analyst to lead investigations into ransomware and compromises. You will work with a tiger team to examine artifacts across Windows, Linux, macOS, and memory forensics, while analyzing diverse logs and correlating findings to IOC/ TTPs.

You will craft concise narratives, map timelines with MITRE ATT&CK/Cyber Kill Chain frameworks, and deliver reports for counsel and partners. Strong communication and team leadership are essential.

Qualifications

• Bachelor's degree in Information Security, Computer Science, Digital Forensics or related field and 4+ years of incident response or digital forensics experience, or Master's/Advanced Degree with 3+ years related experience.
• Certifications such as Security+, Network+, SANS GCED/GCiH/GCFE/GCFA/CEH/CHFI/EnCe are a plus.

Responsibilities

• Lead the Forensics analysis to support engagements for ransomware/compromise investigations.
• Analyze OS artifacts across Windows, Linux, Mac, and RAM/memory forensics.
• Analyze network and system logs including Windows Event Logs, NSM, firewall, and VPN logs.
• Develop clear, narrative forensic findings and timeline of events for different audiences.
• Use ATT&CK and Cyber Kill Chain to contextualize IOCs and TTPs.
• Write and review incident reports and appendices as directed by counsel.

Skills

Forensic analysis

Log analysis

OS artifacts

NIOS logs

Memory forensics

MITRE ATT&CK

SIFT/Volatility

Report writing

Communication to non-technical

Education

Bachelor's degree in Information Security/Computer Science/Digital Forensics

Master's degree in related field

Tools

EnCase

Axiom

FTK

X-Ways

SIFT

Splunk

Redline

Volatility

Wireshark

TCPDump

Job description

Arete is seeking a seasoned Forensics Analyst to lead investigations into ransomware and compromises. You will work with a tiger team to examine artifacts across Windows, Linux, macOS, and memory forensics, while analyzing diverse logs and correlating findings to IOC/ TTPs.

You will craft concise narratives, map timelines with MITRE ATT&CK/Cyber Kill Chain frameworks, and deliver reports for counsel and partners. Strong communication and team leadership are essential.