Senior Digital Forensics Analyst: Ransomware & IOC Expert

Arete; Clifton (TX); On-site; USD 90,000 - 140,000; Full time

Benefits offered by this job

Medical/Dental benefits

Life/Disability Insurance

401(k)

Job summary

Arete is seeking an experienced Forensic Incident Response Analyst to lead detailed investigations of ransomware and compromise engagements. You will work with tiger team analysts to perform OS, memory, and disk forensics across Windows, Linux, and Mac systems, and you’ll analyze logs from multiple sources to identify indicators of compromise.

You will present findings clearly to counsel and partners, driving incident response timelines and ensuring reports follow standard templates.

Qualifications

• Bachelor’s degree with 4+ years in incident response or digital forensics; or Master’s with 3+ years of related experience
• Two or more of the listed certifications: Security+, Network+, SANS GCED, GCIH, GCFE, GCFA, CEH, CHFI, EnCe

Responsibilities

• Lead forensic analysis on ransomware/compromise engagements.
• Analyze OS artifacts and recover deleted items across Windows, Linux, and Mac.
• Analyze network and OS logs including Windows Event logs, NSM, and firewall/VPN logs.
• Collaborate with SOC to identify IOCs and TTPs across variants.
• Prepare clear forensic findings and narrative timelines for diverse audiences.
• Map attacks using MITRE ATT&CK and Cyber Kill Chain frameworks.
• Draft and peer-review investigative reports and appendices.

Skills

Windows forensics

Unix/Linux forensics

Memory forensics

NSM & log analysis

Threat hunting / IOC analysis

Education

Bachelor’s degree in Information Security or related field

Master’s degree in a related field

Tools

EnCase

FTK

X-Ways

SIFT

Splunk

Volatility

Wireshark

TCPDump

Job description

Arete is seeking an experienced Forensic Incident Response Analyst to lead detailed investigations of ransomware and compromise engagements. You will work with tiger team analysts to perform OS, memory, and disk forensics across Windows, Linux, and Mac systems, and you’ll analyze logs from multiple sources to identify indicators of compromise.

You will present findings clearly to counsel and partners, driving incident response timelines and ensuring reports follow standard templates.