Cybersecurity Forensics Analyst - Expert

Huntington National Bank•Atlanta, GA

1d•$70,000 - $140,000•Onsite

About The Position

The Cybersecurity Forensics Analyst - Expert works within Huntington's Digital Forensics & Incident Response (DFIR) team, using enterprise eDiscovery and forensics tools to investigate incidents and support information security incident response. The role collaborates with forensic analysts and works closely with the Cybersecurity Operations Center, Insider Threat team, Corporate Security, Human Resources, and Legal to conduct forensic investigations, process digital evidence for litigation, and respond to cybersecurity incidents. This is an onsite position available at Huntington corporate office locations. The role provides expert forensic and eDiscovery assistance, supports internal and external counsel and investigators, and may testify in court or litigation matters when required. It also provides after-hours on-call incident support on a rotating four-week basis, subject to change.

Requirements

At least 5 years of experience in a forensics or eDiscovery role.
A bachelor's degree or at least 4 additional years of professional forensics and/or adjacent cybersecurity experience.

Nice To Haves

Experience with enterprise eDiscovery or forensics tools and/or Insider Threat monitoring tools.
Experience with Guidance/OpenText Enterprise EnCase, Access Data Forensics Toolkit, or similar solutions in an enterprise-wide deployment.
Hands-on experience implementing or operating security tools such as SIEM, DLP, IPS, anti-malware, and firewalls.
Experience documenting and maintaining procedures or runbooks.
Strong troubleshooting and problem-solving skills.

Responsibilities

Serve as an expert in forensic investigations and liaise with Legal, Corporate Security, Human Resources, and other areas requiring investigative or eDiscovery assistance.
Advise lawyers and investigators on the relevance of data to a case or investigation.
Testify in court or litigation matters as part of findings for internal investigations when required.
Investigate reports of suspicious activity and analyze evidence to determine the who, what, when, and how of incidents.
Use corporate forensic tools and investigative methods to discover, process, and preserve emails and documents that may be needed for litigation, including internet-use history, user-created data, images, and other files.
Work with internal and external counsel, Corporate Security, and Human Resources to provide reports for legal or investigative purposes.
Maintain chain of custody for evidence, including computers, thumb drives, CDs, DVDs, backup tapes, smartphones, tablets, and cameras.
Use file recovery programs to search for and restore deleted data.
Track and report metrics related to the forensics workload.
Work with vendors to understand product roadmaps and plan upgrades.
Provide after-hours on-call incident support on a four-week rotating basis, subject to change.
Document and maintain procedures, runbooks, and other support documents.
Review technical and procedural documentation for systems and solutions to ensure completeness and accuracy.
Provide input to architecture and technology teams on tools, processes, and requirements for forensic investigations and eDiscovery matters.
Maintain current knowledge of hardware, software, and network technology and recommend modifications as required.
Comply with the organization's cybersecurity policies and procedures.