Senior Digital Forensics & IR Lead

Arete; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Arete is seeking an experienced Forensic Analyst to lead ransomware/compromise investigations. You will work with a tiger team to analyze Windows, Linux, Mac artifacts and RAM, review logs, and leverage SOC data to identify IOCs and TTPs.

You will craft clear, audience-appropriate narratives and reports using MITRE ATT&CK and Cyber Kill Chain frameworks, and mentor junior staff. You will deliver forensic findings in a concise manner, participate in incident response planning, and collaborate

Qualifications

• Proficient with Windows, Unix/Linux disk and memory forensics.
• Experience with enterprise security controls.
• Experience delivering technical findings to a non-technical audience (preferred).
• Experience leading teams of analysts (preferred).
• Knowledge of handling sensitive datasets and cyber insurance investigations (preferred).

Responsibilities

• Leads the Forensics analysis to support the Forensic lead on ransomware/compromise investigations.
• Works with tiger team analysts to perform forensic analysis of artifacts across Windows, Linux, Mac, and RAM/memory.
• Analyzes network and OS log files including Windows Event, Unified Audit Logs, Firewall, and VPN logs.
• Collaborates with SOC to leverage alerts from EDR to identify IOCs/TTPS for variants.
• Prepares clear forensic findings in narrative form and tailors delivery to audience and technical capability.
• Employs MITRE ATT&CK and Lockheed Martin Cyber Kill Chain frameworks to contextualize IOCs.
• Reviews and drafts incident reports and appendices; peers review colleagues’ reports.
• Delivers on the Forensic Investigations plan and manages timelines and execution across projects.
• May perform other duties as assigned by management.

Skills

Windows forensics

Linux forensics

Memory forensics

NSM & log analysis

Analyst leadership

Education

Bachelor’s degree in Information Security/CS/Forensics/Cyber Security

Master’s or Advanced Degree + 3+ years experience

Tools

EnCase

Axiom

FTK

X-Ways

SIFT

Splunk

Redline

Volatility

Wireshark

TCPDump

Job description

Arete is seeking an experienced Forensic Analyst to lead ransomware/compromise investigations. You will work with a tiger team to analyze Windows, Linux, Mac artifacts and RAM, review logs, and leverage SOC data to identify IOCs and TTPs.

You will craft clear, audience-appropriate narratives and reports using MITRE ATT&CK and Cyber Kill Chain frameworks, and mentor junior staff. You will deliver forensic findings in a concise manner, participate in incident response planning, and collaborate