Senior DFIR Engineer: Unix/Linux Forensics & IR Lead

Darwinbox Digital Solutions Pvt. Ltd.; San Jose (CA); On-site; USD 130,000 - 180,000; Full time

Job summary

Sonata Software in San Jose, CA seeks a Senior/Staff Digital Forensics and Incident Response Engineer to lead complex investigations, preserve evidence, and develop robust IR playbooks across Linux/Unix, cloud, containers, and enterprise networks.

You will coordinate with SOC and detection engineering teams, translate findings for technical and executive audiences, and drive proactive threat hunting and incident response improvements.

Qualifications

• 6+ years of professional experience in cybersecurity, digital forensics, incident response, or a related discipline.
• Strong hands-on experience with Unix/Linux operating systems and enterprise infrastructure.
• Proven ability to conduct complex computer forensic investigations and security incident response.
• Understanding of MITRE ATT&CK and modern attacker TTPs.
• Experience working in large-scale, high-availability cloud environments.

Responsibilities

• Lead complex digital forensic investigations involving Unix/Linux servers, infrastructure, endpoints, cloud workloads, and enterprise applications.
• Perform forensic acquisition, preservation, analysis, and documentation of compromised systems.
• Investigate security incidents including account compromise, malware, privilege escalation, data exfiltration, and insider threats.
• Develop and maintain forensic playbooks, procedures, and incident response methodologies.
• Coordinate with SOC and engineering teams to translate findings into scalable detections.

Skills

Unix/Linux

Incident response

Digital forensics

Security analytics

Scripting (Python/Bash)

Tools

EnCase

FTK

Autopsy

SleuthKit

Velociraptor

KAPE

Job description

Sonata Software in San Jose, CA seeks a Senior/Staff Digital Forensics and Incident Response Engineer to lead complex investigations, preserve evidence, and develop robust IR playbooks across Linux/Unix, cloud, containers, and enterprise networks.

You will coordinate with SOC and detection engineering teams, translate findings for technical and executive audiences, and drive proactive threat hunting and incident response improvements.