Senior Digital Forensics Analyst - Ransomware & IR

Arete; Clifton (TX); On-site; USD 90,000 - 150,000; Full time

Job summary

Arete is seeking an experienced Forensic Incident Response professional to lead investigations on ransomware and compromise engagements. The role involves analyzing OS artifacts across Windows, Linux, and macOS, plus RAM forensics, network and log analysis, and collaboration with SOC to identify IOCs and TTPs.

You will prepare clear narrative findings, map attacks with MITRE ATT&CK, and draft comprehensive reports for counsel and partners, with opportunities for leadership within a growing

Qualifications

• Bachelor’s degree in Information Security, CS, Digital Forensics or related field.
• 4+ years of incident response or digital forensics experience; or 3+ years with a Master’s/Advanced Degree.
• Two or more certifications listed in the job requirements.

Responsibilities

• Lead forensic analysis on ransomware/compromise engagements.
• Analyze OS artifacts and recover deleted items across Windows, Linux, macOS.
• Analyze network and log files including Windows Event logs and VPN logs.
• Collaborate with SOC to identify IOCs and TTPs.
• Prepare clear narrative reports and timelines for counsel.
• Map attacks using MITRE ATT&CK and Cyber Kill Chain.
• Draft and peer-review incident reports and appendices.
• Oversee forensic investigations plan and timelines.
• May perform other duties as assigned.

Skills

Forensic analysis

Team leadership

Technical writing

Communication

PII/PHI handling

Education

Bachelor’s degree in Information Security or related field

Master’s degree or advanced degree in related field

Tools

EnCase

Axiom

FTK

X-Ways

SIFT

Splunk

Volatility

Wireshark

TCPDump

Open-source forensic tools

Job description

Arete is seeking an experienced Forensic Incident Response professional to lead investigations on ransomware and compromise engagements. The role involves analyzing OS artifacts across Windows, Linux, and macOS, plus RAM forensics, network and log analysis, and collaboration with SOC to identify IOCs and TTPs.

You will prepare clear narrative findings, map attacks with MITRE ATT&CK, and draft comprehensive reports for counsel and partners, with opportunities for leadership within a growing