Responsibilities
- Forensically sound collection, transmission, and storage of digital evidence
- Analysis of digital evidence to identify indicators of compromise and adversary activity
- Development of incident timelines and theories of compromise
- Identification of incident root causes
- Participation in threat actor negotiations as necessary (e.g., ransom negotiations, etc.)
- Participation in incident recovery (e.g., restoration of data from backups, reimaging workstations and servers, rebuilding network infrastructure, etc.) activities as necessary
- Development and delivery of incident reports to document key incident details for engagement stakeholders including executive leaders for insureds, breach coach attorneys, and At-Bay claims management staff as necessary
- Development and delivery of recommendations to mitigate the risk of future incidents for impacted insureds
- Development and delivery of incident response training and simulations for targeted insureds
Requirements
- Previous digital forensics and incident response experience
- Strong oral and written communication skills
- Previous hands-on experience performing digital forensics and incident response, including several of the following: - Business Email Compromise - Ransomware - Digital evidence collection and analysis - Development and analysis of cyber threat intelligence - Leadership of or participation in investigations involving digital evidence - Intrusion detection / cyber threat hunting - Malware analysis - Incident recovery activities such as restoration of data from backups, operation of decryptor tools, etc.
- Previous hands-on experience working in information technology operations (e.g., Network Operations Center, Security Operations Center, Incident Response Team, etc.)
- Strong knowledge of Windows and Unix/Linux operating systems
- Expertise in threat hunting, network forensics, and EDR / EPP technologies
- Bachelor’s degree or equivalent
- Minimum of 4 years of experience in cybersecurity operations, incident response, incident recovery, or another security discipline
Nice to Have
- Significant undergraduate or graduate coursework in computer science, computer engineering, information systems, or cybersecurity
- Previous background in law enforcement or government/military with experience leading complex technical investigations
- Knowledge of cloud environments, including knowledge of cloud security products and services offered by major cloud service providers (e.g., AWS, Azure, Google)
- Experience in a top-10 cyber consulting firm or leading DFIR provider preferred
- One or more industry cybersecurity certifications (e.g., GCIH, Security+, CISSP, etc.)
Additional Information
- Willingness to travel as needed to perform job functions
