Senior Incident Response & Digital Forensics Analyst New York, NY Posted today

Bloomberg; New York (NY); On-site; USD 190,000 - 260,000; Full time

Job summary

Bloomberg L.P. in New York is seeking a Senior Incident Response & Digital Forensics Analyst to lead complex investigations within the CSOC THIR team.

You will analyze host, memory, network, and log evidence, acquire forensic images, and reconstruct attacker activity to determine what happened and the impact. You will mentor the broader team, improve malware analysis, memory forensics, and sustainable detection coverage while collaborating with engineering, legal, and risk groups.

Qualifications

• Significant hands-on experience leading security incident investigations end to end.
• Disk and memory forensics across Windows and Linux, including evidence acquisition and analysis.
• Malware analysis experience, including static and dynamic analysis and extraction of observables.
• Strong knowledge of OS internals across Windows, Linux, and macOS.
• Understanding of networking fundamentals (TCP/IP, DNS, routing) and network evidence analysis.
• Experience using Splunk or a comparable enterprise search and log-analysis platform.
• Experience using endpoint telemetry to determine attacker behavior and identify additional evidence.
• Programming or scripting capability in Python or similar.
• Ability to work independently while mentoring others and seeking additional expertise.
• Strong written and verbal communication skills to explain findings.

Responsibilities

• Lead technical investigations of complex security incidents end to end.
• Establish ground truth quickly during significant incidents and maintain ownership of the investigation.
• Mentor team members, contribute to playbooks, procedures, and knowledge sharing.
• Help shape Bloomberg’s forensic capabilities with tooling and durable detection coverage.
• Collaborate with engineering, legal, compliance and risk teams to support effective response.

Skills

Incident response

Digital forensics

Memory forensics

Malware analysis

OS internals

Networking fundamentals

Splunk

Endpoint telemetry

Python

Threat hunting

Git/Jira/Jupyter

Detection engineering

Forensic tooling

Education

GCFA

GCFE

GREM

GNFA

Tools

Splunk

CrowdStrike Falcon RTR

osquery

Sysmon

Carbon Black

Tanium

Zeek

Suricata

Snort

NetWitness

Job description

Senior Incident Response & Digital Forensics Analyst

Location

New York

Business Area

Legal, Compliance, and Risk

Ref #

10054249

Description & Requirements

Cyber Security Operations Center — Threat Hunting, Intelligence & Incident Response

The Role

Bloomberg’s Cyber Security Operations Center (CSOC) protects the organization by identifying, investigating, and responding to cyber threats. Working closely with Engineering, Legal, Compliance, and other teams across Bloomberg, CSOC provides security monitoring, incident response, threat hunting, and forensic expertise across a complex global technology environment.

As a Senior Incident Response & Digital Forensics Analyst within the Threat Hunting, Intelligence & Incident Response (THIR) team, you will lead the technical investigation of our most complex security incidents and escalations.

You will take ambiguous events where the answer is not immediately apparent and drive them to a defensible conclusion. This includes analyzing host, memory, network, and log evidence; acquiring and examining forensic images; investigating suspicious binaries; and reconstructing attacker activity to determine what happened, how it happened, and the extent of impact.

During significant incidents, you will help establish ground truth quickly, maintain technical ownership of the investigation, and work with stakeholders across Bloomberg to support an effective response.

This role also carries an important leadership expectation: raising the analytical capability of the wider team. Through hands‑on mentoring, incident pairing, playbooks, procedures, and structured knowledge sharing, you will help build deeper expertise in areas such as malware analysis, memory forensics, and log‑based threat hunting.

You will also help shape Bloomberg’s forensic capabilities by contributing to tooling, workflows, investigative standards, and the conversion of lessons learned from incidents into repeatable processes and durable detection coverage.

What You’ll Bring

• Substantial hands‑on experience leading security incident investigations end to end, from initial signal through root‑cause analysis and written conclusion.
• Strong practical experience with disk and memory forensics across Windows and Linux, including evidence acquisition and analysis.
• Demonstrated malware analysis experience, including static and dynamic analysis, safe detonation, and extraction of useful observables for detection and threat hunting.
• Strong knowledge of operating‑system internals across Windows, Linux, and macOS.
• Strong understanding of networking fundamentals, including TCP/IP, DNS, routing, and network evidence analysis.
• Deep hands‑on experience investigating large datasets using Splunk or a comparable enterprise search and log‑analysis platform.
• Experience using endpoint and network telemetry to determine attacker behavior and identify additional evidence when existing visibility is insufficient.
• Programming or scripting capability in any language; Python is commonly used within the team.
• The ability to investigate difficult and unfamiliar problems independently while knowing when to involve others or seek additional expertise.
• Strong written and verbal communication skills, including the ability to explain investigative findings and reasoning clearly.

Experience in one or more of the following areas would be beneficial:

• Memory‑forensics frameworks such as Volatility and structured forensic acquisition tooling.
• Reverse engineering beyond behavioral malware analysis.
• Cloud forensics across AWS, Azure, or GCP, including snapshot‑based acquisition and investigation.
• Threat hunting and knowledge of attacker tools, techniques, and procedures used against enterprise environments.
• CrowdStrike Falcon, particularly Real Time Response (RTR), for remote artifact and evidence collection.
• Humio / LogScale or other large‑scale log‑analysis platforms.
• Endpoint telemetry and EDR technologies such as osquery, Sysmon, Carbon Black, or Tanium.
• Network security monitoring technologies such as Zeek, Suricata, Snort, NetWitness, packet capture, or network IDS.
• Working with detection engineering teams to translate investigative findings into sustainable detection coverage.
• Git, Jira, Jupyter notebooks, or similar development and collaboration tools.
• Relevant certifications such as GCFA, GCFE, GREM, or GNFA.
• Experience applying mainstream commercial AI platforms to security or analytical workflows.

We look for people who demonstrate:

• Curiosity and problem solving — You explore the unknown, ask good questions, seek evidence, and methodically work through difficult problems.
• Persistence — You stay engaged when investigations become complex, incomplete, or difficult to resolve.
• Candor and humility — You are confident in your expertise while being open about what you do not know, receptive to feedback, and willing to involve others.
• Learning agility — You can quickly develop knowledge of unfamiliar technologies, environments, and investigative techniques.
• Collaboration and empathy — You work effectively with people from different technical disciplines, cultures, and backgrounds and respect different perspectives.
• Knowledge sharing — You actively help others improve through mentoring, documentation, pairing, and practical knowledge transfer.

How We Work

THIS is a globally distributed team across New York, EMEA, and APAC. Our follow-the-sun model allows investigations and operational work to transition between regions rather than routinely requiring teams to work outside normal hours.

The role is shift-oriented, and significant incidents may occasionally require support outside standard working hours. When that happens, the team works together globally to manage the response.

Life at Bloomberg

Bloomberg operates in a fast-moving, collaborative environment where people are encouraged to contribute ideas regardless of title. We value high standards, trust, curiosity, teamwork, and giving back to the communities in which we operate.

If this sounds like an environment where you would thrive, we would like to hear from you.

Bloomberg is an equal opportunities employer. We value diversity and do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, disability status, or other protected characteristics.

Salary Range = 190,000 - 260,000 USD Annual + Benefits + Bonus

The referenced salary range is based on the Company's good faith belief at the time of posting. Actual compensation may vary based on factors such as geographic location, work experience, market conditions, education/training and skill level.

• merit increases
• incentive compensation (exempt roles only)
• paid holidays
• paid time off
• medical
• dental
• vision
• short and long term disability benefits
• 401(k) +match
• life insurance
• various wellness programs

Discover what makes Bloomberg unique - watch our for an inside look at our culture, values, and the people behind our success.

Bloomberg is an equal opportunity employer and we value diversity at our company. We do not discriminate on the basis of age, ancestry, color, gender identity or expression, genetic predisposition or carrier status, marital status, national or ethnic origin, race, religion or belief, sex, sexual orientation, sexual and other reproductive health decisions, parental or caring status, physical or mental disability, pregnancy or parental leave, protected veteran status, status as a victim of domestic violence, or any other classification protected by applicable law.

Bloomberg is a disability inclusive employer. Please let us know if you require any reasonable adjustments to be made for the recruitment process. If you would prefer to discuss this confidentially, please email [e-mail]