Sr. Specialist - Digital Security Investigations

Dshield; New York (NY); On-site; USD 90,000 - 120,000; Full time

Job summary

Dshield in New York is seeking a Senior Specialist for its Insider Threat Team to lead digital investigations with a focus on OT environments. The ideal candidate will manage forensic evidence collection and analyze digital data to identify insider threats.

Applicants should have significant experience in digital forensics, strong analytical skills, and the capability to produce detailed reports for both technical teams and leadership. This role involves collaboration with cybersecurity teams to mitigate insider risks effectively.

Qualifications

• 4+ years of experience in Digital Forensics Investigations.
• Experience with digital forensic investigation processes.
• Ability to analyze and draw conclusions from digital evidence.

Responsibilities

• Lead complex insider threat digital investigations.
• Conduct enterprise-wide forensic evidence collection.
• Prepare and deliver clear investigative reports.

Skills

Digital Forensics Investigations

Insider Threat Response

Analytical Skills

Microsoft Office Suite

Education

Bachelor's Degree in a relevant field

Master's Degree

Tools

Commercial forensic tools

Opensource forensic tools

Job description

Sr. Specialist - Digital Security Investigations

Come join us at Con Edison as a Senior Specialist Insider Threat Team! We are seeking a highly skilled and motivated investigator to join our growing Digital Security Investigations team. In this role, you will lead Insider Threat digital investigations with a strong emphasis on OT environments, while supporting IT-related cases as needed. You will conduct complex digital forensic investigations, manage enterprise-wide evidence collection, collaborate with a high performing team, and present impactful findings to senior leadership to drive strategic security decisions.

Responsibilities

• Lead complex insider threat digital investigations, with primary focus on OT/ICS environments and support for IT investigations as required.
• Conduct enterprise-wide forensic evidence collection across IT and OT systems, ensuring accurate, secure, and defensible acquisition with proper chain of custody.
• Analyze digital artifacts to identify insider threat behaviors, attack vectors, indicators of compromise, timelines, and root causes.
• Prepare and deliver clear, concise investigative reports and strategic recommendations to technical teams and executive leadership.
• Serve as a technical subject matter expert (SME) and provide evidence to insider threat investigators and cross functional partners.
• Collaborate with cybersecurity teams (CSOC, Red Team, Engineering, Vulnerability Management) and OT operations teams to enhance detection, response, and mitigation of insider risk.
• Perform advanced forensic analysis, including malware reverse engineering and network traffic analysis using commercial and opensource tools.
• Research emerging insider threat trends and contribute to the development of alerting, detection logic, and investigative methodologies.
• Maintain and enhance digital investigation lab capabilities, support protective intelligence efforts as needed, and participate in oncall and emergency response activities.

Qualifications

Required Education/Experience

• Bachelor's Degree and four years of experience in Digital Forensics Investigations, Insider Threat Response, or other related DFIR experience.
• Master's Degree and two years of experience in Digital Forensics Investigations, Insider Threat Response, or other related DFIR experience.

Preferred Education/Experience

• Master's Degree and two years of experience in Digital Forensics Investigations, Insider Threat Response, or other related DFIR experience.

Relevant Work Experience

• Demonstrated experience conducting digital forensic investigations using commercial and opensource tools is required.
• Strong understanding of insiderthreat policies, investigative procedures, and evidence handling, including strict chainofcustody practices is required.
• Proven ability to analyze digital evidence, develop investigation timelines, perform rootcause analysis, and draw defensible conclusions is required.
• Experience producing clear, wellstructured reports and briefings for both technical teams and executive leadership is required.
• Knowledge of evolving insiderthreat trends, tactics, and threat behaviors is required.
• Understanding of OT/ICS systems, protocols, and architectures is preferred.
• Physical security investigative experience is preferred.

Skills and Abilities

• Demonstrated ability to maintain confidential information.
• Strong verbal communication and listening skills.
• Demonstrated analytical skills.
• Proficient in Microsoft Office including Word, Excel, Outlook and PowerPoint.

Licenses and Certifications

• Accredited Asset Management Specialist (AAMS) Relevant DFIR Certifications; GCIH, GCIA, GCFE, EnCE, GREM, CFCE or similar.