Senior DFIR Engineer - Linux Forensics & Incident Response

Sonata Software North America Inc.; San Jose (CA); On-site; USD 165,000 - 276,000; Part time

Job summary

Sonata Software North America Inc. seeks a Senior/Staff Digital Forensics and Incident Response Engineer to join our Cybersecurity team onsite in San Jose, CA. This contract role requires 6+ years in forensics, incident response, and infrastructure security across large-scale environments.

You will lead investigations, develop playbooks, and coordinate with SOC and engineering teams to contain, analyze, and remediate incidents while communicating findings to leadership.

Qualifications

• 6+ years of professional experience in cybersecurity, digital forensics, incident response.
• Strong hands-on Unix/Linux forensics and enterprise infrastructure.
• Experience with SIEM/EDR and large-scale environments.
• Familiarity with MITRE ATT&CK and incident response workflows.

Responsibilities

• Lead complex digital forensic investigations across Unix/Linux servers and cloud workloads.
• Perform forensic acquisition, preservation, and analysis of compromised systems.
• Investigate incidents including credential theft, malware, lateral movement, persistence.
• Develop forensic playbooks and incident response procedures.
• Collaborate with SOC and engineering teams; present findings to leadership.
• Build scalable detection capabilities from forensic findings.

Skills

Unix/Linux forensics

Incident response

Cloud forensics

Threat hunting

Scripting (Python/Bash)

Tools

EnCase

FTK

Autopsy

Sleuth Kit

Velociraptor

KAPE

Volatility

Job description

Sonata Software North America Inc. seeks a Senior/Staff Digital Forensics and Incident Response Engineer to join our Cybersecurity team onsite in San Jose, CA. This contract role requires 6+ years in forensics, incident response, and infrastructure security across large-scale environments.

You will lead investigations, develop playbooks, and coordinate with SOC and engineering teams to contain, analyze, and remediate incidents while communicating findings to leadership.