Lead Security Analyst (Digital Forensics and Incident Response))

Gartner • Irving, TX

5d • Hybrid

About The Position

This is a new role within Gartner’s Security Operations team, focused on Digital Forensics and Incident Response (DFIR). The Lead Security Analyst leads complex investigations, conducts forensic analysis across enterprise systems, and helps Gartner respond to, contain, and recover from cybersecurity incidents. The role provides technical leadership for investigations involving advanced threats, insider risk, legal and regulatory matters, and high-priority security events.

The position requires deep expertise in digital forensics, evidence handling, incident response, and threat analysis, along with the ability to communicate findings clearly to technical and non-technical audiences. The analyst collaborates with Security Operations, Threat Intelligence, Legal, Human Resources, Privacy, Compliance, and Engineering teams to protect Gartner’s people, data, and intellectual property.

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Digital Forensics, or a related field, or equivalent practical experience.
• At least 7 years of experience in digital forensics and incident response, including at least 2 years in a senior or lead capacity.
• Experience leading complex incident response investigations.
• Experience using Python, PowerShell, or similar scripting languages to automate forensic workflows and evidence processing.
• Hands-on experience with digital forensics tools and platforms such as Magnet Forensics, EnCase, Volatility, MemProcFS, FTK, KAPE, UAC, Autopsy/Sleuth Kit, Velociraptor, or equivalent tools.
• Experience with cloud forensics in AWS and Azure, including investigations involving cloud-native services and Kubernetes or containerized workloads.
• Strong hands-on experience with Windows, macOS, Linux, and memory forensics.
• Strong proficiency with EDR/XDR, SIEM and SOAR platforms, network forensics, and log analysis.
• Experience with platforms and tools such as Splunk, Microsoft Sentinel, Athena, Zscaler, ExtraHop, and Wireshark.
• Experience performing malware analysis, reverse engineering, and threat hunting.
• Excellent written and verbal communication skills, including producing clear forensic reports and explaining technical concepts to non-technical stakeholders.
• Experience conducting insider threat or HR/Legal-driven investigations.
• Strong command of evidence handling, chain of custody, and forensically sound acquisition, including live response and remote collection.

Nice To Haves

• Relevant industry certifications such as GCFA, GCFE, GNFA, GCIH, GREM, EnCE, or equivalent.
• Experience supporting legal, eDiscovery, compliance, privacy, or regulatory investigations.
• Experience using AI or large language models to improve DFIR investigative efficiency while preserving evidentiary standards.
• Familiarity with investigations involving AI-related security incidents or emerging technology risks.
• Experience building custom forensic utilities, maintaining research projects, contributing to open-source tools, or publishing technical content.
• Advanced experience integrating forensic, SIEM, EDR, and cloud security platforms through APIs and automation.

Responsibilities

• Lead digital forensic investigations involving cybersecurity incidents, insider threats, Human Resources matters, legal requests, and regulatory inquiries.
• Conduct forensic acquisition and analysis of endpoints, cloud workloads, network artifacts, log data, and volatile system evidence.
• Develop and maintain DFIR playbooks and standard operating procedures that meet legal and evidentiary standards.
• Perform advanced log analysis across multiple data sources to establish timelines, identify root causes, and validate investigative findings.
• Develop automation and tooling to improve investigative efficiency and evidence collection.
• Identify opportunities to improve detection, response, forensic readiness, and evidence preservation capabilities.
• Mentor junior investigators and contribute to the growth and maturity of Gartner’s DFIR program.
• Produce clear and defensible forensic reports for internal stakeholders, auditors, legal counsel, and executive leadership.

Benefits

• Competitive compensation
• Growth and learning opportunities
• Mentorship and apprenticeship
• Leadership courses, development programs, technical courses, and certification opportunities
• Collaborative and positive culture
• Flexible work-from-home arrangements and office collaboration
• 20+ PTO days, holidays, and floating holidays in the first year
• Medical insurance
• Dental insurance
• Vision plan
• 401(k) with corporate match and immediate vesting
• Health and wellness allowance programs
• Parental leave
• Tuition reimbursement
• Employee Stock Purchase Plan
• Employee Assistance Program
• Gartner Gives Charity Match

What This Job Offers

• Job Type: Full-time
• Career Level: Senior