Lead Security Analyst (Digital Forensics and Incident Response))

Forensic Focus; Stamford (CT); Hybrid; USD 140,000 - 210,000; Full time

Job summary

Forensic Focus in Stamford, CT seeks a Lead Security Analyst specializing in Digital Forensics and Incident Response. You will lead investigations, coordinate with legal, HR and security teams, and guide junior analysts while shaping incident response playbooks and defensible forensic reports.

The role requires 7+ years in DFIR, strong scripting, and hands-on experience with Magnet, EnCase, Volatility, FTK, KAPE, Autopsy and Velociraptor, plus cloud forensics across AWS/Azure and EDR/SIEM/SOAR

Qualifications

• Minimum 7+ years in DFIR with senior leadership experience.
• Proficiency in Python/PowerShell scripting.
• Hands-on experience with leading DFIR tools and cloud forensics.

Responsibilities

• Lead digital forensic investigations across cybersecurity incidents, insider threats, HR matters and legal requests.
• Oversee forensic acquisition and analysis of endpoints, cloud workloads, network data and memory.
• Develop playbooks, automation and defensible forensic reports.
• Collaborate with legal, HR and security teams on high-priority investigations.

Skills

Leadership

Scripting (Python/PowerShell)

Tools

Magnet

EnCase

Volatility

FTK

KAPE

Autopsy

Velociraptor

Cloud forensics (AWS/Azure)

EDR/SIEM/SOAR platforms

Job description

# Lead Security Analyst (Digital Forensics and Incident Response))*Gartner***Stamford, CT**Hybrid · Lead/Principal · Full-time### The RoleThis position leads digital forensic investigations spanning cybersecurity incidents, insider threats, HR matters and legal requests. Responsibilities include forensic acquisition and analysis of endpoints, cloud workloads, network data and volatile memory, plus developing playbooks, automation and defensible forensic reports.### Skills & ExperienceRequires 7+ years in DFIR, including senior leadership experience, scripting (Python/PowerShell), and tools such as Magnet, EnCase, Volatility, FTK, KAPE, Autopsy and Velociraptor. Cloud forensics (AWS/Azure), EDR/SIEM/SOAR platforms, malware analysis and strong evidence handling practices are essential.### Who It SuitsIdeal for an experienced forensic investigator ready to take a technical leadership role, mentor junior analysts, and work cross-functionally with legal, HR and security teams on high-priority, sensitive investigations.