Lead Security Analyst (Digital Forensics and Incident Response))

Gartner • Stamford, CT

7d • $94,000 - $134,000 • Hybrid

About The Position

This is a lead role in Gartner's Security Operations team, focused on Digital Forensics and Incident Response (DFIR). The Lead Analyst leads complex investigations, performs forensic analysis across enterprise systems, and helps Gartner respond to, contain, and recover from cybersecurity incidents. The role serves as a technical leader for investigations involving advanced threats, insider risk, legal and regulatory matters, and high-priority security events. It requires expertise in digital forensics, evidence handling, incident response, and threat analysis, along with clear communication to technical and non-technical audiences. The analyst collaborates with Security Operations, Threat Intelligence, Legal, Human Resources, Privacy, Compliance, and Engineering to protect Gartner's people, data, and intellectual property. The role is based near Gartner's Irving, Texas or Stamford, Connecticut Centers of Excellence, with a flexible hybrid environment.

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, or a related field, or equivalent practical experience.
• At least 7 years of experience in digital forensics and incident response, including at least 2 years in a senior or lead capacity and experience leading complex incident response investigations.
• Experience with Python, PowerShell, or similar scripting languages to automate and accelerate forensic workflows and evidence processing.
• Hands-on experience with digital forensics tools and platforms, including Magnet Forensics, EnCase, Volatility, MemProcFS, FTK, KAPE, UAC, Autopsy/Sleuth Kit, Velociraptor, or equivalent platforms.
• Experience with cloud forensics in AWS and Azure, including investigations involving cloud-native services and Kubernetes/containerized workloads.
• Strong hands-on experience in Windows, macOS, Linux, and memory forensics.
• Strong proficiency with EDR/XDR, SIEM and SOAR platforms such as Splunk, Microsoft Sentinel, and Athena; network forensics tools such as Zscaler, ExtraHop, and Wireshark; and log analysis.
• Experience performing malware analysis, reverse engineering, and threat hunting.
• Excellent written and verbal communication skills, including producing clear forensic reports and explaining technical concepts to non-technical stakeholders.
• Experience conducting insider threat or HR/Legal-driven investigations.
• Strong command of evidence handling, chain of custody, and forensically sound acquisition, including live response and remote collection.
• Ability to manage multiple priorities, investigate and connect disparate data points, communicate findings and recommendations, improve workflows, collaborate across teams, and stay current with evolving threats and investigative techniques.

Nice To Haves

• Relevant industry certifications such as GCFA, GCFE, GNFA, GCIH, GREM, EnCE, or equivalent.
• Experience supporting legal, eDiscovery, compliance, privacy, or regulatory investigations.
• Experience leveraging AI/LLMs to enhance DFIR investigations and efficiency while preserving evidentiary standards.
• Familiarity with investigations involving AI-related security incidents or emerging technology risks.
• Experience building custom forensic utilities, maintaining research projects, contributing to open-source tools, or publishing technical content.
• Advanced experience integrating forensic, SIEM, EDR, and cloud security platforms through APIs and automation.

Responsibilities

• Lead digital forensic investigations involving cybersecurity incidents, insider threats, human resources matters, legal requests, and regulatory inquiries.
• Conduct forensic acquisition and analysis of endpoints, cloud workloads, network artifacts, log data, and volatile system evidence.
• Develop and maintain DFIR playbooks and standard operating procedures that meet legal and evidentiary standards.
• Perform advanced log analysis across multiple data sources to establish timelines, identify root cause, and validate investigative findings.
• Develop automation and tooling to improve investigative efficiency and evidence collection capabilities.
• Identify opportunities to improve detection, response, forensic readiness, and evidence preservation capabilities.
• Mentor junior investigators and contribute to the growth and maturity of Gartner's DFIR program.
• Produce clear, defensible forensic reports for internal stakeholders, auditors, legal counsel, and executive leadership.

Benefits

• Competitive compensation and an annual bonus plan based on company and individual performance, or a role-based uncapped sales incentive plan, as applicable.
• Growth and learning opportunities, including mentorship, apprenticeship, leadership courses, development programs, technical courses, and certification opportunities.
• Flexible hybrid work environment, with the flexibility to work from home and collaborate in offices.
• 20+ PTO days, holidays, and floating holidays in the first year.
• Medical, dental, and vision insurance.
• 401(k) with corporate match and immediate vesting; the posting also notes a match up to $7,200 per year.
• Health-and-wellness-related allowance programs.
• Parental leave.
• Tuition reimbursement.
• Employee Stock Purchase Plan, including the opportunity to purchase company stock at a discount.
• Employee Assistance Program.
• Gartner Gives Charity Match.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior