As part of the expansion of our teams, we are looking for an experienced DFIR Analyst to work on security incident investigation and response missions.
Key Responsibilities
- Investigate and respond to security incidents across the client’s environment
- Triage and investigate alerts escalated by the SOC to confirm incidents
- Perform forensic analysis (endpoint, network, memory, cloud) to establish root cause, scope and timeline
- Collect and preserve digital evidence following chain-of-custody procedures
- Identify indicators of compromise (IOCs) and adversary TTPs, and share them with CTI and Detection Engineering teams
- Support containment, eradication and recovery actions in coordination with IT and infrastructure teams
- Collaborate with SOC, CTI, Detection Engineering and Red Team on incident handling and lessons learned
- Draft incident reports and post-incident reviews, including root cause and remediation recommendations
- Contribute to and refine IR playbooks and runbooks
Required Skills
Technical:
- Strong hands-on DFIR experience: endpoint, network, memory and cloud forensics
- Strong experience with Splunk (SPL, correlation searches, multi-source log analysis)
- Proficiency with forensic tools: EnCase, FTK, Velociraptor, KAPE, Volatility or equivalent
- Experience with Microsoft Defender for Endpoint (MDE) and Microsoft Defender for Identity (MDI) for investigation and containment
- Working knowledge of the MITRE ATT&CK framework
- Understanding of evidence handling and chain-of-custody standards, ideally with exposure to legal and regulatory requirements
- Malware triage and analysis fundamentals (static and dynamic)
Nice to have:
- Scripting skills in Python and/or PowerShell for artifact parsing and automation
- Familiarity with cloud forensics (AWS, Azure, GCP)
Soft skills:
- Clear technical writing for reports aimed at both technical and management audiences
- Rigor, strong analytical mindset and ability to work under pressure during active incidents
Profile
- 4 to 6 years of experience in incident response and digital forensics
- Professional English required
