Senior Unix/Linux Forensics & Incident Engineer (Onsite)

Forensic Focus Limited; San Jose (CA); On-site; USD 90,000 - 154,000; Full time

Job summary

Forensic Focus Limited in San Jose, CA is seeking a Senior Unix/Linux DFIR Engineer to lead advanced forensic investigations and incident response across on-premises servers, cloud workloads and Kubernetes environments. You will own acquisition, analysis, timeline reconstruction and threat hunting, producing actionable IOCs and clear executive summaries.

You will communicate findings to engineering teams and global leadership, bridging deep technical work with effective reporting under pressure

Qualifications

• 8+ years in cybersecurity with deep hands-on expertise in Linux/Unix forensic artefact analysis.
• Experience with SIEM and EDR platforms.
• Cloud environments (AWS, Azure, GCP) and MITRE ATT&CK mapping.
• Live-response techniques;rootkit analysis;container forensics;CI/CD infrastructure investigation.

Responsibilities

• Lead complex forensic investigations and incident response across Unix/Linux servers, cloud workloads, Kubernetes environments, and enterprise applications.
• Perform forensic acquisition, timeline reconstruction, threat hunting, develop IOCs, and report findings to stakeholders globally.

Skills

Linux forensics

Incident response

SIEM

EDR

Cloud security (AWS/Azure/GCP)

Kubernetes

Threat hunting

IOCs development

Tools

Rootkit analysis

Container forensics

CI/CD security investigations

Job description

Forensic Focus Limited in San Jose, CA is seeking a Senior Unix/Linux DFIR Engineer to lead advanced forensic investigations and incident response across on-premises servers, cloud workloads and Kubernetes environments. You will own acquisition, analysis, timeline reconstruction and threat hunting, producing actionable IOCs and clear executive summaries.

You will communicate findings to engineering teams and global leadership, bridging deep technical work with effective reporting under pressure