Senior Incident Response & Digital Forensics Lead

Bloomberg L.P.; New York (NY); On-site; USD 190,000 - 260,000; Full time

Job summary

Bloomberg L.P. in New York is seeking a Senior Incident Response & Digital Forensics Analyst to lead complex investigations within the CSOC THIR team.

You will analyze host, memory, network, and log evidence, acquire forensic images, and reconstruct attacker activity to determine what happened and the impact. You will mentor the broader team, improve malware analysis, memory forensics, and sustainable detection coverage while collaborating with engineering, legal, and risk groups.

Qualifications

• Significant hands-on experience leading security incident investigations end to end.
• Disk and memory forensics across Windows and Linux, including evidence acquisition and analysis.
• Malware analysis experience, including static and dynamic analysis and extraction of observables.
• Strong knowledge of OS internals across Windows, Linux, and macOS.
• Understanding of networking fundamentals (TCP/IP, DNS, routing) and network evidence analysis.
• Experience using Splunk or a comparable enterprise search and log-analysis platform.
• Experience using endpoint telemetry to determine attacker behavior and identify additional evidence.
• Programming or scripting capability in Python or similar.
• Ability to work independently while mentoring others and seeking additional expertise.
• Strong written and verbal communication skills to explain findings.

Responsibilities

• Lead technical investigations of complex security incidents end to end.
• Establish ground truth quickly during significant incidents and maintain ownership of the investigation.
• Mentor team members, contribute to playbooks, procedures, and knowledge sharing.
• Help shape Bloomberg’s forensic capabilities with tooling and durable detection coverage.
• Collaborate with engineering, legal, compliance and risk teams to support effective response.

Skills

Incident response

Digital forensics

Memory forensics

Malware analysis

OS internals

Networking fundamentals

Splunk

Endpoint telemetry

Python

Threat hunting

Git/Jira/Jupyter

Detection engineering

Forensic tooling

Education

GCFA

GCFE

GREM

GNFA

Tools

Splunk

CrowdStrike Falcon RTR

osquery

Sysmon

Carbon Black

Tanium

Zeek

Suricata

Snort

NetWitness

Job description

Bloomberg L.P. in New York is seeking a Senior Incident Response & Digital Forensics Analyst to lead complex investigations within the CSOC THIR team.

You will analyze host, memory, network, and log evidence, acquire forensic images, and reconstruct attacker activity to determine what happened and the impact. You will mentor the broader team, improve malware analysis, memory forensics, and sustainable detection coverage while collaborating with engineering, legal, and risk groups.