Unix/Linux Infrastructure Forensics & Incident Engineer

Forensic Focus Limited; San Jose (CA); Hybrid; USD 90,000 - 154,000; Full time

Job summary

Forensic Focus Limited in San Jose, CA is seeking a Senior Unix/Linux DFIR Engineer to lead advanced forensic investigations and incident response across on-premises servers, cloud workloads and Kubernetes environments. You will own acquisition, analysis, timeline reconstruction and threat hunting, producing actionable IOCs and clear executive summaries.

You will communicate findings to engineering teams and global leadership, bridging deep technical work with effective reporting under pressure

Qualifications

• 8+ years in cybersecurity with deep hands-on expertise in Linux/Unix forensic artefact analysis.
• Experience with SIEM and EDR platforms.
• Cloud environments (AWS, Azure, GCP) and MITRE ATT&CK mapping.
• Live-response techniques;rootkit analysis;container forensics;CI/CD infrastructure investigation.

Responsibilities

• Lead complex forensic investigations and incident response across Unix/Linux servers, cloud workloads, Kubernetes environments, and enterprise applications.
• Perform forensic acquisition, timeline reconstruction, threat hunting, develop IOCs, and report findings to stakeholders globally.

Skills

Linux forensics

Incident response

SIEM

EDR

Cloud security (AWS/Azure/GCP)

Kubernetes

Threat hunting

IOCs development

Tools

Rootkit analysis

Container forensics

CI/CD security investigations

Job description

# Unix/Linux Infrastructure Forensics & Incident Engineer*Canvendor***San Jose, CA**Onsite · Senior · Contract### The RoleThis senior position leads complex forensic investigations and incident response across Unix/Linux servers, cloud workloads, Kubernetes environments, and enterprise applications. Day-to-day work includes forensic acquisition and analysis, timeline reconstruction, threat hunting, developing IOCs, and communicating findings to technical and executive stakeholders globally.### Skills & ExperienceCandidates need 8+ years in cybersecurity with deep hands-on expertise in Linux/Unix forensic artefact analysis, SIEM and EDR platforms, cloud environments (AWS, Azure, GCP), MITRE ATT&CK mapping, and live-response techniques. Experience with rootkit analysis, container forensics, and CI/CD infrastructure investigation is highly valued.### Who It SuitsThis role suits a seasoned DFIR engineer comfortable operating under pressure in large-scale enterprise environments. Those with a background in infrastructure security who can bridge deep technical investigation with clear reporting to both engineering teams and senior leadership will thrive here.Typical advertised salary forDigital Forensics roles in United States:**$90,000–$154,000**(median $122,000 — from207 recent listings analysed by Forensic Focus).Compare Digital Forensics salaries in United States →Learn More/Apply