DFIR Engineer

Tokio Marine HCC

46d

About The Position

Vector3, Inc., is an incident response firm supporting TMHCC Cyber and Professional Lines Group (CPLG). Vector3 specializes in responding to Business Email Compromise (BEC) and Ransomware incidents, helping insured organizations investigate, contain, and recover from cyber related incidents. Building on our success in incident response, we are launching a Managed Detection and Response (MDR) service designed to protect our DFIR clients from future incidents. The MDR program will deliver proactive monitoring, detection, and prevention solutions — powered by tools like Sophos EDR/NDR, Microsoft 365, and Google Workspace. Join us as a DFIR Engineer and take a role in shaping our digital forensics and incident response practice for TMHCC-CPLG insureds. In this position, you'll combine technical expertise to drive complex engineering initiatives that enhance the scale, speed, and precision of our investigations. You'll join a team of talented engineers through hands-on problem-solving, build scalable solutions for evolving threats, and help refine our consulting capabilities.

Requirements

Minimum 4 year / bachelor’s degree in cyber security, Computer Science, Information Technology related degree or relevant professional work experience
2 years in leading active cybersecurity engagements, developing security automation and/or SOAR capabilities in support of security incident response, digital forensics, malware analysis or threat intelligence
Proven track record of success in managing complex engineering initiatives.
Experience in conducting security investigations in Linux and Windows environments.
Understanding of cloud platforms and security considerations within AWS (Amazon Web Services), Azure, Microsoft 365, and GCP (Google Cloud Platform).
Proficient scripting/programming skills: PowerShell, Bash, Python, Go, Rust
Proficiency and experience with CI/CD: Jenkins, GitHub Actions, GitLab CI, Circle CI
Proficiency and experience with containerization: Docker, Kubernetes
Experience working with middleware or SOAR platforms: Tines, Splunk, Swimlane Cortex XSOAR
Experience working with RESTful APIs for security automation.
Experience with EDR solutions (Defender, SentinelOne, CrowdStrike)
Experience with threat intelligence platforms or open-source solutions.
Experience with malware analysis methodologies.
Experience administering various enterprise grade security tools and databases: SIEM, IAM, EDR, firewalls, IDS/IPS, VPN, data warehouses, DLP
Experience with data backup and recovery, data replication, and data archival technologies.
Experience with hypervisor technologies: VMWare, MS Hyper-V
Strong understanding of legal and regulatory frameworks related to cyber security such as PCI, NIST CSF, or other industry-specific regulations.
Excellent communication and presentation skills to clearly and concisely communicate complex technical findings to clients and stakeholders.
Strong leadership abilities to motivate and mentor team members.
Superior organizational and analytical skills; demonstrated ability to manage multiple tasks simultaneously.
Knowledgeable of industry changes, legal updates, and technical developments related to applicable area of the Company’s business to proactively respond to changing business environment.
Advanced proficiency and experience using Microsoft Office package (Excel, Access, PowerPoint, Word).

Nice To Haves

Advanced degrees or certifications in security (CISSP, CISM, GCFE, GCFA, GREM, GBFA, GCIH, CFCE, CCE) or cloud engineering (AWS Certified Security, Azure Security Engineer, Google Professional Cloud Security Engineer, CCNA, MCSE) are a plus.

Responsibilities

Assign tasks, delegate responsibilities, and provide mentorship to team members.
Support development and maintenance of operating procedures and best practices for engineering team.
Maintain positive, professional insured/carrier relationships.
Foster a culture of innovation, continuous learning, and skill development within the engineering team.
Understand insured needs and tailor strategies to address specific business risks and compliance requirements.
Communicate complex engineering concepts internally and externally.
Develop and maintain engineering automation in support of incident response plans aligned with industry best practices.
Stay informed about emerging engineering technologies and industry best practices.
Understand and be aware of digital forensics methodologies for evidence collection, analysis, and reporting.
Provide expert technical guidance on engineering methodologies, automation techniques, software development and recovery techniques.
Occasionally, support complex digital forensic investigations, including analysis of system logs, network traffic, and endpoint data.
Follow work plans, established timelines, and predefined goals for assigned work.
Meet commitments on deadlines.
Communicate activities, results, and observations with employees and management as appropriate.
Identify areas for improvement in existing business practices.
Perform work thoroughly in a cost-efficient manner and at a high productivity level.
Comply with all corporate policies and procedures.
Report any breakdowns in controls to management.
Conduct all activities in a safe manner.