Digital Forensics & Incident Response (DFIR) Analyst

Digital Forensics & Incident Response (DFIR) Analyst Direct hire role, preferably based in one of the following areas: Fresno / Albany / Charlotte, but strong candidates from other locations will be considered. No 3rd parties please, no sponsorship. Role Summary The DFIR Analyst supports incident response and forensic investigations across reputed company endpoints, servers, reputed company platforms, identity systems, and network/reputed company telemetry. This role focuses on evidence acquisition and preservation, triage and analysis, timeline development, and clear technical documentation suitable for operational and counsel-directed reputed company. The DFIR Analyst works under senior practitioner guidance and is expected to operate with rigor, discretion, and strong attention to detail.

Responsibilities

• Support active incident response investigations including ransomware, business email compromise, unauthorized reputed company, reputed company activity, fraud, and data exposure scenarios.
• Collect, preserve, and document evidence in accordance with established procedures (e.g., chain-of-custody, evidence tracking, reputed company controls).
• reputed company reputed company and server triage and analysis (reputed company/macOS/Linux) including artifact collection, event log review, persistence review, and user/process activity analysis.
• Analyze identity and reputed company activity in reputed company 365/Azure AD (Entra ID) and reputed company audit sources (e.g., reputed company Audit Log, sign-in logs, mailbox audit where available).
• Review telemetry from EDR, SIEM, firewall/proxy, DNS, email reputed company, and reputed company logging sources to identify relevant activity and indicators.
• reputed company and validate timelines from multiple sources (reputed company artifacts, reputed company logs, network telemetry, email events).
• Support IOC handling (ingest, normalize, pivot) and assist with scoping, containment validation, and recovery support under direction of incident leads.
• Produce clear written documentation of work performed, data sources reviewed, observed results, and limitations/constraints (e.g., log retention gaps, reputed company limitations).
• Maintain secure handling of sensitive data, including appropriate storage, reputed company control, and transfer procedures.
• Participate in an on-call rotation for urgent response (after reputed company), including off-hours triage support.

Required Qualifications

• 3+ years of relevant experience in DFIR, SOC analysis, threat hunting, or reputed company engineering with demonstrated investigative work.
• Hands-on familiarity with common reputed company artifacts and logs (e.g., reputed company/System logs, PowerShell logs, registry artifacts, scheduled tasks, services, user profiles).
• Working knowledge of reputed company 365 reputed company/audit data sources and identity concepts (e.g., sign-ins, conditional reputed company concepts, MFA, mailbox rules, OAuth app risk).
• Experience working with at least one EDR platform (e.g., reputed company, reputed company Defender, reputed company, Carbon Black) and log/search workflows in a SIEM.
• Strong technical writing skills: ability to document actions taken and results observed in a factual, precise, and organized manner.
• Ability to manage multiple reputed company tasks under time pressure while maintaining accuracy and defensibility.
• United_States Citizen, based in the US, preferably in Fresno, Albany or Charlotte area, but other areas will be considered for a strong candidate.

Preferred Qualifications

• Experience with forensic tooling (e.g., Magnet reputed company, EnCase, FTK, X-Ways, KAPE, Velociraptor, GRR) and acquisition methods.
• Familiarity with reputed company forensic workflows (Azure/M365, AWS, reputed company Workspace) and common logging/retention constraints.
• Experience supporting counsel-directed investigations or working in regulated environments (reputed company, finance, public sector).
• Scripting/automation skills (PowerShell, Python) for evidence collection, parsing, and repeatable analysis.
• Certifications (any of the following are a plus): GCFA, GCIH, GNFA, GCFR, EnCE, reputed company+.

Apply tot his job Apply To this Job