Senior Digital Forensics & Incident Response Analyst

Arete IR; United States; On-site; USD 110,000 - 170,000; Full time

Job summary

Arete Incident Response is seeking an experienced Forensic Analyst to lead investigations involving ransomware and compromises. You will analyze artifacts across Windows, Linux, Mac, and memory, working with the SOC to map IOCs and TTPs, and craft clear, audience-appropriate narrative findings.

You will develop attack maps, draft investigative reports, and contribute to the Forensic Investigations plan while coordinating with counsel and partners.

Qualifications

• Bachelor's degree in Information Security, Computer Science, Digital Forensics, Cyber Security or related field and 4+ years of incident response or digital forensics experience or Master's or Advanced Degree and 3+ years related experience
• Possess two or more of the following Certifications: Security+, Network+, SANS GCED, GCIH, GCFE, GCFA, CEH, CHFI, EnCe

Responsibilities

• Leads the Forensics analysis to support the Forensic lead, on engagements for Ransomware/compromise investigations
• Performs forensic analysis of artifacts across Windows, Linux, Mac, and RAM forensics
• Analyzes network and operating system logs including Windows Event logs, Unified Audit Logs, Firewall logs, and VPN logs
• Leverages EDR data with SOC to identify IOCs or TTPs
• Prepares clear forensic findings and timelines in narrative form for diverse audiences
• Develops attack maps using MITRE ATT&CK and Cyber Kill Chain
• Drafts and peer-reviews incident and investigative reports
• Delivers on the Forensic Investigations plan and manages timelines
• May perform other duties as assigned by management

Skills

Forensics analysis

Windows/Linux/macOS forensics

NSM & log analysis

Threat hunting

Communicating findings

Team leadership

PII/PHI handling

Cyber insurance investigations

Problem solving

Microsoft Office

Education

Bachelor's degree in Information Security / Computer Science / Digital Forensics

Master's degree (optional)

Tools

EnCase

Axiom

FTK

X-Ways

SIFT

Splunk

Volatility

Wireshark

TCPDump

Job description

Arete Incident Response is seeking an experienced Forensic Analyst to lead investigations involving ransomware and compromises. You will analyze artifacts across Windows, Linux, Mac, and memory, working with the SOC to map IOCs and TTPs, and craft clear, audience-appropriate narrative findings.

You will develop attack maps, draft investigative reports, and contribute to the Forensic Investigations plan while coordinating with counsel and partners.