Digital Forensics & Incident Response (DFIR) Consultant

About this task

The Digital Forensics & Incident Response (DFIR) Consultant investigates cybersecurity incidents, conducts digital forensic examinations, and supports the containment, eradication, and recovery of security threats across customer environments. The role provides specialist technical expertise in incident investigation, evidence preservation, compromise assessments, and advanced threat analysis.

Digital Forensics & Incident Investigation
- Conduct digital forensic investigations across endpoints, servers, networks, and cloud environments to identify evidence of malicious activity and security compromise.
- Acquire, preserve, and analyze digital evidence, including memory, system artifacts, and security logs, to determine incident scope, root cause, and potential impact.
- Maintain accurate chain-of-custody records and ensure forensic evidence is handled, documented, and preserved in accordance with established procedures.
- Perform forensic analysis of compromised systems to reconstruct attack timelines, identify indicators of compromise (IOCs), and determine attacker activities.
- Utilize forensic investigation tools and methodologies to support accurate and defensible technical findings.

Incident Response & Threat Containment
- Lead technical response activities for major security incidents escalated by Level 2 and Level 3 SOC Analysts.
- Investigate security incidents to determine attack vectors, affected systems, potential exposure, and appropriate remediation actions.
- Coordinate technical containment, eradication, recovery, and post-incident monitoring activities with relevant stakeholders.
- Conduct compromise assessments to identify indicators of intrusion, unauthorized access, and other suspicious activities across customer environments.
- Support root cause analysis and post-incident reviews to identify security weaknesses and recommend corrective measures.

Malware Analysis & Threat Investigation
- Perform initial analysis and triage of malware, phishing emails, suspicious files, and exploit artifacts to identify malicious behavior and indicators of compromise.
- Analyze endpoint, network, and cloud security telemetry to identify attack patterns and potential threats.
- Investigate suspicious activities across Microsoft 365, Microsoft Entra ID, and other enterprise platforms.
- Collaborate with Cyber Threat Intelligence teams to incorporate relevant threat intelligence into investigations and response activities.
- Translate investigation findings into actionable recommendations to improve threat detection and response capabilities.