Senior Forensics Analyst – Incident Response Lead

Arete Event Staffing Firm; Texas; On-site; USD 110,000 - 160,000; Full time

Benefits offered by this job

Medical/Dental benefits

Life/Disability Insurance

401(k)

Job summary

Arete Incident Response in Texas seeks a seasoned Forensic Analyst to lead investigations into ransomware and compromises, analyzing OS artifacts across Windows, Linux, Mac, and memory. You will work with tiger team analysts and the SOC to identify IOCs and TTPs and craft a clear narrative timeline.

You will develop attack maps using MITRE ATT&CK and the Cyber Kill Chain, review and draft reports, and deliver findings to counsel and partners.

Qualifications

• Bachelor’s degree in Information Security, Computer Science, Digital Forensics, Cyber Security or related field.
• 4+ years of incident response or digital forensics experience (or 3+ with Master’s)
• Certifications: Security+, Network+, SANS GCED, GCIH, GCFE, GCFA, CEH, CHFI, EnCe (two or more)
• Ability to work independently with minimal supervision
• Experience communicating findings to non-technical audiences

Responsibilities

• Lead forensic analysis on ransomware/compromise engagements.
• Analyze Windows/Linux/Mac artifacts and memory dumps.
• Review logs from Windows Event Logs, NSM, firewall, VPN, etc.
• Leverage EDR data to identify IOCs and TTPs.
• Draft clear forensic findings and narrative timelines.
• Develop attack maps using MITRE ATT&CK and Cyber Kill Chain.
• Review and draft incident reports and appendices.
• Deliver investigations plans and manage timelines across projects.

Skills

Forensic analysis

Memory forensics

Log analysis

Incident response

Verbal and written communication

Education

Bachelor's degree in Information Security, Computer Science, Digital Forensics, Cyber Security or related field

Master's or Advanced Degree (preferred)

Tools

EnCase

FTK

X-Ways

SIFT

Splunk

Volatility

Wireshark

TCPDump

Job description

Arete Incident Response in Texas seeks a seasoned Forensic Analyst to lead investigations into ransomware and compromises, analyzing OS artifacts across Windows, Linux, Mac, and memory. You will work with tiger team analysts and the SOC to identify IOCs and TTPs and craft a clear narrative timeline.

You will develop attack maps using MITRE ATT&CK and the Cyber Kill Chain, review and draft reports, and deliver findings to counsel and partners.