Operate and maintain DFIR toolsets including forensic imaging, memory analysis, and network packet capture solutions Support incident response teams during breach investigations by preparing and executing data acquisition tasks (disks, memory, logs) Perform triage and basic analysis of forensic artifacts under supervision of senior investigators Assist in correlating forensic data from EDR/XDR platforms, SIEM tools, and OT network monitoring systems Conduct forensic evidence handling and documentation in accordance with chain of custody standards Participate in red/blue/purple team exercises, cyber drills, and readiness testing Contribute to the setup and tuning of DFIR tools including lab environments and virtual sandboxes Maintain tool integrations, script automation where required, and ensure operational availability of forensic toolkits Stay updated with new forensic tool capabilities and cyberattack techniques relevant to OT/IT

Technical Skills & Tools:

Working knowledge of tools like: Disk & Memory Forensics: FTK Imager, Magnet AXIOM, Autopsy, Volatility Network Analysis: Wireshark, tcpdump Log & Endpoint Analysis: CrowdStrike, SentinelOne, Sysmon, ELK Stack Cloud Forensics: AWS CloudTrail, Azure Monitor (preferred) Familiarity with MITRE ATT&CK framework, IOC analysis, and basic scripting (Python, Bash, PowerShell) Exposure to OT/ICS protocol logs such as Modbus, DNP3, or OPC is a strong advantage

 

Qualifications & Certifications:

Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or related field Certifications preferred: CHFI, GCFA, GCFE, or equivalent (can be ongoing) 5 + years of experience in cybersecurity, with at least 2 years in DFIR or SOC operations with forensic exposure

 

Personality Traits:

Highly analytical with strong attention to detail Eager to learn and take on challenging investigative assignments Reliable team player with excellent written documentation skills Comfortable working in sensitive and time-critical incident environments