Senior DFIR Lead - Digital Forensics & Incident Response

Gartner; Fort Myers (FL); Hybrid; USD 94,000 - 134,000; Full time

Benefits offered by this job

Competitive compensation

Hybrid work environment with in-office

Extensive benefits and PTO

Professional growth opportunities

Tuition reimbursement

Job summary

Gartner IT is seeking a Lead DFIR Analyst to lead complex digital forensic investigations across endpoints, cloud workloads and networks, aligning with Security Operations and Legal teams. You will produce clear, defensible reports and mentor junior investigators in a collaborative, high-stakes environment.

Premium topics include incident response, threat analysis, and tooling development to improve detection, response, and evidence preservation while communicating risk to executives.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, or equivalent practical experience.
• 7+ years of experience in digital forensics and incident response, with at least 2 years in a senior or lead capacity.
• Experience leading complex incident response investigations.
• Proficiency with Python, PowerShell or similar scripting for automation.

Responsibilities

• Lead digital forensic investigations involving cybersecurity incidents and regulatory inquiries.
• Conduct forensic acquisition and analysis of endpoints, cloud workloads, networks, and logs.
• Develop and maintain DFIR playbooks and procedures meeting evidentiary standards.
• Perform advanced log analysis to establish timelines and root cause.
• Develop automation and tooling to improve investigative efficiency.
• Identify opportunities to improve detection, response, and evidence preservation.
• Mentor junior investigators and grow Gartner's DFIR program.
• Produce clear forensic reports for stakeholders, auditors, and leadership.

Skills

Digital forensics

Incident response

Python / PowerShell

Forensic tooling

Cloud forensics AWS Azure

Windows / macOS / Linux

EDR/XDR, SIEM, SOAR

Malware analysis

Reverse engineering

Threat hunting

Communication to stakeholders

Insider HR/Legal investigations

Evidence handling / chain of custody

Education

Bachelor's in CS / Cybersecurity / Digital Forensics

Tools

Magnet Forensics

EnCase

Volatility

MemProcFS

FTK

KAPE

UAC

Autopsy/Sleuth Kit

Velociraptor

Job description

Gartner IT is seeking a Lead DFIR Analyst to lead complex digital forensic investigations across endpoints, cloud workloads and networks, aligning with Security Operations and Legal teams. You will produce clear, defensible reports and mentor junior investigators in a collaborative, high-stakes environment.

Premium topics include incident response, threat analysis, and tooling development to improve detection, response, and evidence preservation while communicating risk to executives.