Senior DFIR Lead: Digital Forensics & Incident Response

Gartner

Fort Myers (FL)

Hybrid

USD 94,000 - 134,000

Full time

3 days ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

Competitive compensation

Hybrid work environment

Mentorship and professional growth

Extensive medical, dental and vision

401K with company match

Stock purchase plan

Parental leave

Tuition reimbursement

Employee assistance program

Flexible PTO and holidays

Job summary

Gartner IT seeks a Lead DFIR Analyst to guide complex investigations, perform forensic analysis across enterprise systems, and help contain cyber incidents. You will communicate findings to technical and non-technical audiences, collaborating with Security Operations, Threat Intelligence, Legal, HR, Privacy, and Compliance teams.

Lead investigations involving advanced threats and insider risk, while mentoring junior staff and developing DFIR playbooks and reporting.

Qualifications

Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, related fields, or equivalent practical experience.
7+ years of experience in digital forensics and incident response, with at least 2 years in a senior or lead capacity.
Experience using Python, PowerShell or other scripting languages to automate forensic workflows.
Hands-on experience with digital forensics tools and platforms listed in the job description.
Experience with cloud forensics in AWS and Azure, including Kubernetes/containerized workloads.
Strong hands-on experience across Windows, macOS, Linux, and memory forensics.
Proficiency with EDR/XDR, SIEM and SOAR platforms, network forensics, and log analysis.
Experience in malware analysis, reverse engineering, and threat hunting.
Excellent written and verbal communication; ability to produce clear forensic reports for stakeholders.

Responsibilities

Lead digital forensic investigations involving cybersecurity incidents and regulatory inquiries.
Perform forensic acquisition and analysis of endpoints, cloud workloads, network artifacts, and logs.
Develop and maintain DFIR playbooks and SOPs meeting evidentiary standards.
Conduct advanced log analysis to establish timelines and root causes.
Build automation and tooling to improve investigative efficiency.
Improve Gartner's detection, response, and forensic readiness capabilities.
Mentor junior investigators and grow Gartner's DFIR program.
Produce clear, defensible forensic reports for auditors and leadership.