DFIR , Forensics , SOC, VAPT

• Lead or support the containment, eradication, and recovery of cybersecurity incidents including malware infections, data exfiltration, privilege abuse, and APT activity.
  
• Coordinate with stakeholders across IT, SOC, Legal, and Risk during active incidents.
  
• Document incident timelines and create post-mortem reports with root cause analysis.
  

2.     Forensic Investigation & Digital Forensics

• Collect, preserve, and analyze digital evidence in a forensically sound manner, ensuring chain of custody.
  
• Conduct forensic investigations of compromised endpoints, servers, cloud systems, email, and mobile devices.
  
• Use forensic tools (e.g., EnCase, FTK, X-Ways, Autopsy, Sleuth Kit, Volatility, Velociraptor) to analyze disk, memory, registry, browser artifacts, system logs, and deleted files, for all digital assets.
  
• Support internal investigations involving fraud, data leakage, IP theft, or employee misconduct.
  
• Work with multiple compliance departments to produce evidence reports and contribute to eDiscovery when required.
  

3.     Threat Analysis

• Perform static and dynamic malware analysis and reverse engineering.
  
• Develop Indicators of Compromise (IOCs), analyze TTPs using MITRE ATT&CK framework.
  
• Collaborate with threat intelligence teams to enrich investigations with contextual insights.
  

4.     Post-Incident Review & Process Improvement

• Create detailed incident and investigation reports for technical and executive audiences.
  
• Recommend preventive controls, detection improvements, and SOC playbook updates.
  
• Maintain forensic investigation procedures aligned with legal, compliance, and regulatory needs.
  

Required Skills & Qualifications:

• Bachelor’s degree in Cybersecurity, Digital Forensics, Computer Science, or a related field.
  
• 4+ years of experience in DFIR, forensic investigation, or cyber threat analysis roles.
  
• Proficient with forensic tools such as EnCase, FTK, Autopsy, X-Ways, Volatility, Sleuth Kit, Velociraptor.
  
• Hands-on experience with EDR, SIEM, and log analysis, Malware analysis etc.. platforms
  
• In-depth knowledge of OS internals (Windows, Linux, macOS), file systems, memory structure, and network protocols.
  
• Familiarity with legal protocols for evidence handling and regulatory compliance.
  

Preferred Certifications:

• GCFA – GIAC Certified Forensic Analyst
  
• CHFI – Computer Hacking Forensic Investigator
  
• GCIH / GCIA / GNFA – GIAC Incident or Network Forensic Certifications
  
• OSCP / CCFP / EnCE / CFCE – (Bonus)
  

Key Competencies:

• Strong investigative and analytical mindset
  
• Excellent communication and documentation skills
  
• Able to work independently under pressure and during live incidents
  
• Familiar with chain of custody, litigation support, and legal evidence standards