Digital Forensics and Incident Response(DFIR)

Job Overview:

1. Incident Response:

   Respond to and manage cybersecurity incidents, including threat detection, containment, eradication, recovery, and post-incident activities

2. Threat Hunting:

   Proactively hunt for threats within our environment, utilizing tools such as Anomali ThreatStream to identify potential security risks.

3. Digital Forensics

   : Conduct digital forensic investigations to determine the root cause of security incidents and identify areas for improvement.

4. Correlation and Analysis:

   Correlate security event logs from various sources to identify potential security threats and anomalies.

5. Documentation and Reporting:

   Maintain accurate and detailed records of incidents, including incident reports, root cause analysis, and lessons learned.

ESSENTIAL JOB FUNCTIONS:

• Review security alerts escalated by SOC analysts to determine if they constitute an incident.
• Investigate incidents to determine scope and impact.
• Record incident details, artifacts, and evidence in the incident tracking system
• Execute response protocols and playbooks to respond to incidents
• Escalate incident response protocols to senior staff when necessary
• Communicate with end users to collect information and resolve issues
• Collaborate with IT, Legal, and Marketing teams during the incident response process

SUPPLEMENTAL JOB FUNCTIONS:

• Performs additional duties as directed.
• Effectively accomplishes set goals while primarily working in a hybrid capacity.
• Will need to be available on an on-call basis for off-hours critical incident response.

Key Skills -

• Strong understanding of digital forensics techniques, incident response processes, and cybersecurity principles.
• Familiarity with industry-standard tools like EnCase, FTK, Magnet Axiom, and other specialized forensic software.
• Using SIEM tools and other security monitoring technologies to identify and analyze security events
• Strong ability to analyze security events and identify patterns and anomalies
• Understanding data recovery techniques and tools.