Unix/Linux Infrastructure Forensics & Incident Engineer

Strategic Resources International Inc; San Jose (CA); On-site; USD 170,000 - 230,000; Full time

Job summary

Strategic Resources International Inc seeks a Senior/Staff Digital Forensics and IR Engineer to lead forensic investigations across Unix/Linux servers, cloud workloads, and enterprise apps. You will perform acquisition, analysis, documentation, and timeline reconstruction to map attacker activity and impact.

You will develop and maintain playbooks, incident response methodologies, and coordinate with SOC, infrastructure, and legal teams during high-severity incidents.

Qualifications

• 6+ years in cybersecurity, forensics, IR, or related field.
• Strong hands-on experience with Unix/Linux OS and enterprise infra.
• Proven experience conducting complex computer forensic investigations and IR.

Responsibilities

• Lead complex DFIR investigations across Unix/Linux, cloud workloads, and enterprise apps.
• Perform forensic acquisition, preservation, analysis, and documentation.
• Develop forensic playbooks, procedures, and IR methodologies.
• Lead incident response during high-severity events and coordinate with SOC.
• Investigate cloud, containers, and modern infra security incidents.

Skills

Unix/Linux

Incident Response

Digital Forensics

Scripting

Cloud Forensics

Memory Forensics

Tools

Volatility

EnCase

FTK

Autopsy

Sleuth Kit

KAPE

Job description

Level: Senior/Staff Digital Forensics and IR Engineer Function: Cybersecurity / Digital Forensics

About The Role

Key Responsibilities

Digital Forensics & Incident Response

• Lead complex digital forensic investigations involving Unix/Linux servers, infrastructure, endpoints, cloud workloads, and enterprise applications.
• Perform forensic acquisition, preservation, analysis, and documentation of compromised systems.
• Investigate security incidents including:
• Account compromise and credential theft
• Malware and rootkits
• Privilege escalation
• Lateral movement
• Persistence mechanisms
• Data exfiltration
• Insider threats
• Supply-chain compromises
• Web/application server compromises
• Cloud infrastructure attacks

Analyze system artifacts including filesystem metadata, logs, processes, memory, network connections, authentication records, scheduled tasks, services, SSH activity, shell history, and persistence mechanisms.Conduct timeline analysis and attack reconstruction to determine initial access, attacker activity, persistence, lateral movement, and impact.Develop and maintain forensic playbooks, investigation procedures, and incident response methodologies.

Unix/Linux Infrastructure Forensics

• Perform deep forensic analysis of Linux/Unix operating systems, including RHEL, CentOS, Ubuntu, Debian, SUSE, and other enterprise distributions.
• Investigate compromised infrastructure including:
• Web servers
• Application servers
• Database servers
• DNS/DHCP infrastructure
• Authentication services
• Kubernetes/container hosts
• CI/CD infrastructure
• Build systems
• Source-code repositories
• Network infrastructure

Analyze Linux artifacts such as /var/log, /etc, /proc, /sys, systemd, cron, SSH configuration, authentication logs, bash history, package databases, filesystem metadata, and kernel/process information.Investigate rootkits, kernel-level persistence, malicious binaries, unauthorized users, SSH keys, modified system services, and privilege escalation.Perform live-response investigations while minimizing evidence contamination.

Incident Response & Threat Hunting

• Participate in and lead high-severity incident response investigations across global enterprise infrastructure.
• Develop hypotheses and conduct proactive threat hunting across Linux, cloud, identity, network, and application environments.
• Correlate forensic evidence with SIEM, EDR, network telemetry, cloud logs, authentication data, and threat intelligence.
• Identify attacker TTPs and map activity to frameworks such as MITRE ATT&CK.
• Develop indicators of compromise (IOCs), behavioral detections, and threat-hunting queries.
• Work with SOC and detection engineering teams to convert forensic findings into scalable detection capabilities.

Cloud, Containers & Modern Infrastructure

• Investigate incidents involving AWS, Azure, Google Cloud Platform, and hybrid environments.
• Perform forensic analysis of cloud workloads, virtual machines, containers, Kubernetes clusters, and cloud control-plane activity.
• Investigate compromised containers, images, orchestration infrastructure, CI/CD pipelines, and software supply chains.
• Understand cloud-native logging, identity, networking, storage, and workload telemetry.

Malware & Artifact Analysis

• Analyze suspicious files, scripts, binaries, and system artifacts.
• Perform basic static and dynamic analysis of malware and attacker tooling.
• Identify malicious scripts involving Bash, Python, Perl, PowerShell, and other scripting languages.
• Collaborate with malware reverse engineers when deeper binary analysis is required.

Investigation Automation & Tooling

• Develop Python, Bash, or other automation tools to accelerate forensic collection, triage, evidence analysis, and incident response.
• Build scalable forensic collection and investigation capabilities across thousands of enterprise systems.
• Automate IOC searches, log analysis, timeline generation, artifact collection, and evidence correlation.
• Evaluate and integrate modern DFIR and AI-assisted investigation technologies.

Incident Management & Executive Communication

• Serve as a technical lead during critical security incidents.
• Coordinate with Security Operations, Infrastructure, Cloud, Networking, IAM, Engineering, Legal, Privacy, and other stakeholders.
• Produce high-quality forensic investigation reports, root-cause analyses, and remediation recommendations.
• Clearly communicate technical findings, business impact, risk, and recommended actions to senior leadership.

Required Qualifications

• 6+ years of professional experience in cybersecurity, digital forensics, incident response, infrastructure security, or a related discipline.
• Strong hands-on experience with Unix/Linux operating systems and enterprise infrastructure.
• Proven experience conducting complex computer forensic investigations and security incident response.
• Strong understanding of Linux internals, filesystems, processes, memory, networking, authentication, and system services.
• Experience investigating compromised servers and enterprise infrastructure.
• Strong knowledge of TCP/IP, DNS, HTTP/HTTPS, SSH, TLS, VPN, firewalls, proxies, and network security.
• Experience with SIEM, EDR/XDR, network security monitoring, vulnerability management, and security telemetry.
• Experience with scripting/programming languages such as Python, Bash, Perl, or PowerShell.
• Understanding of MITRE ATT&CK and modern attacker TTPs.
• Experience working in large-scale, high-availability high-tech or cloud environments.
• Strong analytical, problem-solving, documentation, and communication skills.
• Ability to work effectively during high-severity incidents and under time-sensitive conditions.

Preferred Qualifications

• Experience with AWS, Azure, or Google Cloud Platform forensics.
• Experience with Kubernetes, Docker, containers, and cloud-native infrastructure.
• Experience with memory forensics using tools such as Volatility.
• Experience with forensic platforms and tools such as EnCase, FTK, Autopsy, Sleuth Kit, Velociraptor, KAPE, or equivalent technologies.
• Experience with Linux forensic frameworks and live-response tooling.
• Experience with malware analysis and reverse engineering.
• Knowledge of identity attacks involving Active Directory, LDAP, Kerberos, SSO, OAuth, and cloud identity.
• Experience investigating software supply-chain and CI/CD compromises.
• Experience with threat intelligence and adversary tracking.
• Experience building automated DFIR capabilities at enterprise scale.
• Experience using AI/ML technologies to enhance threat hunting, forensic analysis, and incident response.

Certifications

Preferred Certifications Include

• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Examiner (GCFE)
• GIAC Advanced Incident Response, Threat Hunting & Digital Forensics (GAIA)
• GIAC Certified Intrusion Analyst (GCIA)
• GIAC Reverse Engineering Malware (GREM)
• GCFA or equivalent advanced DFIR certification
• CISSP

Core Competencies

Technical

• Linux/Unix Forensics
• Digital Forensics
• Incident Response
• Threat Hunting
• Malware Analysis
• Network Forensics
• Cloud Forensics
• Container/Kubernetes Security
• Infrastructure Security
• Identity & Authentication
• SIEM/EDR/XDR
• Detection Engineering
• Security Automation

Leadership

• Incident leadership
• Cross-functional collaboration
• Executive communication
• Root-cause analysis
• Risk assessment
• Crisis management
• Security investigation strategy