Forensic Analyst I

Arete

About The Position

The Forensic Analyst I supports the Senior Analyst, Forensics Leads, and Tiger Team on assigned active projects. The role performs triage-level analysis of collected data, such as operating system files, images, SentinelOne data, and logs, as well as advanced forensic analysis. The Digital Forensics & Incident Response (DFIR) team supports clients and helps restore business operations during incidents by identifying threat actor behavior and activity. The analyst conducts forensic investigations across Windows, Apple Mac, and Linux systems, and network appliances such as VPN and firewall appliances. They document findings, develop timelines and visual attack maps, identify additional data sources and collection gaps, and work with SOC and cross-functional teams to investigate incidents and inform response. The role also contributes to threat intelligence, communicates findings to technical and non-technical audiences, and prepares investigative updates and reports using standard templates and, when directed, under counsel partners’ direction. The position requires an associate’s degree and at least four years of incident response or digital forensics experience, or a relevant bachelor’s degree, along with one or more listed certifications. The work environment is described as usual office working conditions. Travel within or outside the state may be required. Salary and benefits are provided consistent with Arete policy; the role is exempt from FLSA overtime provisions.

Requirements

Associate’s degree and at least 4 years of incident response or digital forensics experience, or a bachelor’s degree in Information Security, Computer Science, Digital Forensics, Cyber Security, or a related field.
Possess one or more of the following certifications: Security+, Network+, SANS GCED, GCIH, GCFE, GCFA, CEH, or CHFI.
Deep understanding of forensic artifacts, including operating system artifacts and recovery of deleted items across Windows, Linux, Mac, and RAM/memory forensics.
Experience analyzing network and operating system log files, including Windows Event logs, Unified Audit Logs, firewall logs, and VPN logs.
Working knowledge of Windows disk and memory forensics.
Working knowledge of Network Security Monitoring (NSM), network traffic analysis, and log analysis.
Working knowledge of Unix or Linux disk and memory forensics.
Experience and understanding of enterprise security controls.
Experience with EnCase, Axiom, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, Wireshark, TCP Dump, and other open-source forensic tools.

Nice To Haves

Experience delivering technical findings to a non-technical audience.
Ability to present findings in a confident, factual manner.
Knowledge and experience handling PII, PHI, and sensitive, confidential, and proprietary datasets.
Experience with cyber insurance investigations.

Responsibilities

Perform digital forensic analysis on Windows, Apple Mac, and Linux operating systems, as well as network appliances such as VPN and firewall appliances.
Document forensic findings in the Arete Forensic Tracker and develop a master timeline and visual attack map of events.
Identify additional systems, logs, and other sources to collect based on analysis, and identify gaps in evidence across the attack lifecycle.
Work with the Security Operations Center to use monitoring and alert data from installed applications and EDR solutions to identify indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs).
Present forensic findings and updates clearly, using a narrative timeline and adapting delivery to the audience’s technical capabilities.
Track investigation findings and data points to enhance and inform threat intelligence.
Raise technical constraints and issues within the Forensics team and escalate relevant incident details to Forensic leadership.
Maintain analyst notes, the Forensic Tracker, timelines, and attack maps in the centralized case location.
Draft detailed investigative updates and conclusions about the timing and mechanism of initial intrusion, adversary actions, lateral movement, and indicators of data access or exfiltration.
Identify, document, and share critical IOCs and adversary TTPs with Incident Response, Threat Intelligence, and Security Operations teams.
Communicate identified IOCs to the Tiger Team to support the investigation, restoration and response, and improvements to the client’s security posture.
Use incident-mapping frameworks such as MITRE ATT&CK and the Lockheed Martin Cyber Kill Chain to contextualize adversary actions and IOCs.
Produce written incident and investigative updates and reports at the explicit direction of counsel partners.
Communicate within the DFIR team and provide routine status updates in the case management platform.
Collaborate with cross-functional teams, including Threat Intelligence, SOC, Threat Hunting, and Negotiations teams, to incorporate relevant intelligence into the incident response.
Draft reports and appendices using standard report templates.
Accurately track and record time spent on forensic analysis.
Perform other duties as assigned by management.