Senior DFIR Lead: Digital Forensics & IR

Gartner; Stamford (CT); Hybrid; USD 94,000 - 134,000; Full time

Benefits offered by this job

PTO and holidays

401k match

Stock purchase plan

Job summary

Gartner is seeking a Lead DFIR Analyst to guide investigations, perform digital forensic analyses, and drive incident response across enterprise systems. You will lead complex investigations, develop playbooks, and communicate findings to technical and non-technical audiences while collaborating with Legal, HR, Privacy and Engineering teams.

The role emphasizes experience with Windows/Linux/macOS, cloud forensics, and threat hunting within a collaborative, hybrid work environment.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, or equivalent practical experience.
• 7+ years in digital forensics and incident response, with at least 2 years in a lead capacity.
• Experience scripting to automate forensic workflows (Python/PowerShell).
• Hands-on with DFIR tools and cloud forensics (AWS/Azure).
• Strong communication of technical findings to non-technical stakeholders.

Responsibilities

• Lead digital forensic investigations of cybersecurity incidents, insider threats, HR/legal requests, and regulatory inquiries.
• Perform forensic acquisition/analysis of endpoints, cloud workloads, network artifacts, logs, and memory.
• Develop and sustain DFIR playbooks/SOPs meeting evidentiary standards.
• Conduct advanced log analysis to establish timelines and root cause.
• mentor junior investigators and contribute to DFIR program maturity.

Skills

Python/PowerShell

DFIR

Threat analysis

Incident response

Communication

Lead investigations

Education

Bachelor's degree in CS/Cybersecurity/DF

Tools

Magnet Forensics

EnCase

Volatility

FTK

KAPE

Job description

Gartner is seeking a Lead DFIR Analyst to guide investigations, perform digital forensic analyses, and drive incident response across enterprise systems. You will lead complex investigations, develop playbooks, and communicate findings to technical and non-technical audiences while collaborating with Legal, HR, Privacy and Engineering teams.

The role emphasizes experience with Windows/Linux/macOS, cloud forensics, and threat hunting within a collaborative, hybrid work environment.