Remote Cybersecurity Incident Response & Digital Forensics

Softthink Solutions; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Softthink Solutions is seeking a highly experienced Cybersecurity Incident Response & Digital Forensics Specialist to support time-sensitive investigations within federal IT environments. You will lead rapid triage, forensic analysis, and threat response, analyzing logs across SIEM, EDR, endpoints, networks, and cloud environments.

Ideal candidates have 8+ years in cybersecurity and 5+ years in incident response or forensics, with familiarity in KEV, NIST guidelines, and evidence handling.

Qualifications

• 8+ years of professional experience in cybersecurity, information security, or related technical disciplines.
• 5+ years of hands-on experience in cybersecurity incident response, digital forensics, or security investigations.
• Demonstrated experience investigating cybersecurity incidents within enterprise or federal IT environments.
• Strong understanding of vulnerability exploitation, incident response processes, and digital forensic methodologies.
• Experience analyzing SIEM, EDR, endpoint, network, and cloud security logs.
• Working knowledge of Windows and Linux operating systems, security architecture, and common attack techniques.
• Familiarity with the CISA KEV Catalog, NIST SP 800-61, NIST SP 800-86, and federal cybersecurity practices.
• Experience preserving digital evidence and preparing technically defensible investigation reports.
• Strong analytical, troubleshooting, technical documentation, and communication skills.
• Ability to respond to urgent cybersecurity incidents and work within accelerated investigation timelines.

Responsibilities

• Conduct rapid cybersecurity incident triage, forensic investigations, and security assessments to identify potential exploitation, unauthorized access, and system compromise.
• Investigate vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog and assess potential exploitation across enterprise IT environments.
• Analyze endpoint, network, application, authentication, SIEM, EDR, vulnerability scanning, and cloud audit logs to identify suspicious activities and indicators of compromise.
• Perform forensic investigations to identify persistence mechanisms, privilege escalation, lateral movement, command-and-control communications, and potential data exposure.
• Collect, preserve, analyze, and document digital evidence following NIST SP 800-86 and established forensic evidence-handling practices.
• Develop incident response plans and recommend containment, eradication, recovery, and risk mitigation strategies.
• Collaborate with cybersecurity teams, system administrators, cloud engineers, and stakeholders to investigate and resolve security incidents.
• Escalate confirmed or suspected security compromises and provide actionable technical recommendations.
• Prepare forensic investigation reports, incident timelines, technical findings, executive summaries, and remediation recommendations.
• Support rapid incident response activities, including initial incident acknowledgment, forensic triage, daily status updates, and incident closeout documentation.
• Maintain accurate investigation records, evidence logs, chain-of-custody documentation, and supporting technical artifacts.
• Ensure incident response activities align with federal cybersecurity requirements, NIST guidance, and organizational security policies.

Job description

Softthink Solutions is seeking a highly experienced Cybersecurity Incident Response & Digital Forensics Specialist to support time-sensitive investigations within federal IT environments. You will lead rapid triage, forensic analysis, and threat response, analyzing logs across SIEM, EDR, endpoints, networks, and cloud environments.

Ideal candidates have 8+ years in cybersecurity and 5+ years in incident response or forensics, with familiarity in KEV, NIST guidelines, and evidence handling.