Senior Incident Responder – Remote Forensics Lead

SOClogix; Catonsville (MD); Hybrid; USD 100,000 - 145,000; Full time

Benefits offered by this job

Health, dental, and vision insurance

401(k) with company match

Unlimited PTO

Annual certification and training

Job summary

SOClogix, Inc. is seeking an experienced Incident Responder to lead cyber incident investigations for managed security clients.

You will triage, contain, eradicate, and recover from breaches while coordinating with client IT teams, legal, insurers, and law enforcement as needed. Your work includes digital forensics across endpoints, servers, cloud environments, and network infrastructure, with malware and memory analysis to define scope and impact.

Qualifications

• 3+ years in incident response, forensics, or security operations.
• Hands-on with forensic tools: Velociraptor, KAPE, FTK, Autopsy, X-Ways or similar.
• Strong knowledge of Windows/Linux forensic artifacts and event logs.
• Experience with SIEM (OpenSearch, Splunk, Sentinel) and EDR (LimaCharlie, CrowdStrike, SentinelOne).
• Understanding of MITRE ATT&CK and applying it to investigations.
• Excellent written and verbal communication, capable of briefing executives.

Responsibilities

• Lead incident response engagements from triage to remediation and post-incident review.
• Perform digital forensics across endpoints, servers, cloud, and network.
• Analyze malware, memory, and logs to determine scope and impact.
• Contain active threats including ransomware, BEC, data exfiltration, insider threats.
• Prepare incident reports with timelines, findings, and remediation recommendations.
• Coordinate with client IT, legal, insurers, and law enforcement as needed.
• Develop incident response playbooks, runbooks, and escalation procedures.
• Contribute to post-incident lessons learned and security posture improvements.
• Support on-call rotation for 24/7 incident response.

Skills

Incident response

Digital forensics

Security operations

Forensic tooling

OpenSearch

Splunk

EDR tooling

MITRE ATT&CK

Executive briefing

Education

GCIH/GCFA/GCFE/GREM/EnCE

Tools

Velociraptor

KAPE

FTK

Autopsy

X-Ways

OpenSearch

Splunk

LimaCharlie

CrowdStrike

SentinelOne

Azure AD

M365

AWS CloudTrail

Job description

SOClogix, Inc. is seeking an experienced Incident Responder to lead cyber incident investigations for managed security clients.

You will triage, contain, eradicate, and recover from breaches while coordinating with client IT teams, legal, insurers, and law enforcement as needed. Your work includes digital forensics across endpoints, servers, cloud environments, and network infrastructure, with malware and memory analysis to define scope and impact.