Remote DFIR Cyber Analyst - Incident Response & Forensics

At-Bay; United States; Remote; USD 80,000 - 115,000; Full time

Job summary

At-Bay is seeking a Cybersecurity Analyst focused on Digital Forensics and Incident Response to provide incident investigation and response services for At-Bay insureds. The role covers evidence collection, analysis, timelines, root-cause identification, and coordination with stakeholders, including breach coaches and claims teams.

Responsibilities include incident recovery support, risk mitigation recommendations, and delivery of IR training and simulations.

Qualifications

• Bachelor's degree or equivalent.
• Minimum of 2 years of experience in cybersecurity operations, incident response, or related security discipline.
• Willingness to travel as needed to perform job functions.

Responsibilities

• Forensically sound collection, transmission, and storage of digital evidence.
• Analyze digital evidence to identify indicators of compromise and adversary activity.
• Develop incident timelines and theories of compromise.
• Identify incident root causes.
• Participate in threat actor negotiations as necessary (e.g., ransom negotiations).
• Participate in incident recovery activities (backup restoration, reimaging, rebuilding networks).
• Develop and deliver incident reports for stakeholders including executives, breach coaches, and claims staff.
• Develop and deliver recommendations to mitigate future incidents.
• Develop and deliver incident response training and simulations for targeted insureds.

Skills

Digital forensics

Incident response

Communication

IT operations

Investigation leadership

Threat hunting

Malware analysis

Ransomware

Data recovery

Education

Bachelor's degree

Tools

Decryptor tools

Job description

At-Bay is seeking a Cybersecurity Analyst focused on Digital Forensics and Incident Response to provide incident investigation and response services for At-Bay insureds. The role covers evidence collection, analysis, timelines, root-cause identification, and coordination with stakeholders, including breach coaches and claims teams.

Responsibilities include incident recovery support, risk mitigation recommendations, and delivery of IR training and simulations.