Senior Network DFIR Lead: Forensics & Incident Response

Verizon; Cary (NC); Hybrid; USD 101,000 - 194,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

Verizon is seeking a Senior Engineer in the Security Defense organization to own the network DFIR lifecycle across Core, Edge, and Access networks. You will lead technical investigations during major security events, drive containment and root-cause analysis, and strengthen forensic readiness with automation and scripting.

The role requires deep experience in digital forensics, incident response, and SIEM data analysis, with hands-on work on EnCase, FTK, Volatility, X-Ways, SANS SIFT, and KAPE.

Qualifications

• Bachelor’s degree or four or more years of relevant work experience.
• Four+ years in digital forensics, network security engineering, or incident response.
• Deep experience with SIEM/data analysis platforms (Splunk, ELK).
• Strong proficiency in forensic acquisition and analysis suites (EnCase, FTK, Volatility, X-Ways, SANS SIFT, KAPE).
• Expert knowledge of core network protocols (TCP/IP, BGP, OSPF, DNS, TLS, HTTP/S) and telemetry formats (NetFlow, IPFIX, syslog).

Responsibilities

• Lead technical investigations and incident response during major security events.
• Own the DFIR lifecycle across Core, Edge, and Access networks.
• Analyze PCAP, NetFlow/IPFIX, firewall logs, and router/switch artifacts.
• Analyze memory dumps and endpoint state to uncover malware and persistence.
• Develop and maintain YARA rules and detection logic.
• Automate artifact collection and triage workflows.
• Develop DFIR playbooks and runbooks for high-impact incidents.
• Produce detailed forensic reports with timelines and remediation recommendations.

Skills

Network forensics

Incident response

Automation scripting

SIEM data analysis

Digital forensics

Threat hunting

Education

Bachelor's degree or 4+ years experience

Tools

EnCase

FTK

Volatility

X-Ways

SANS SIFT

KAPE

Splunk

ELK

Job description

Verizon is seeking a Senior Engineer in the Security Defense organization to own the network DFIR lifecycle across Core, Edge, and Access networks. You will lead technical investigations during major security events, drive containment and root-cause analysis, and strengthen forensic readiness with automation and scripting.

The role requires deep experience in digital forensics, incident response, and SIEM data analysis, with hands-on work on EnCase, FTK, Volatility, X-Ways, SANS SIFT, and KAPE.