Senior Analyst, Forensics

Arete • Texas - Remote, TX

13d

About The Position

The Senior Analyst, Forensics leads forensic analysis supporting the Forensic lead on ransomware and compromise investigations. The role works with tiger team analysts to examine forensic artifacts, including operating system artifacts and deleted-item recovery across Windows, Linux, and Mac, as well as RAM and memory forensics. It analyzes network and operating-system logs and uses data from Security Operations Center alerts and Endpoint Detection and Response solutions to identify indicators of compromise and tactics, techniques, and procedures relevant to investigations.

The position prepares clear, audience-appropriate findings and updates, develops attack maps using incident-mapping frameworks, and drafts investigative updates, reports, and appendices under the direction of counsel and partners. It also performs peer reviews and works with the lead to manage forensic investigation plans, timelines, delivery, and execution. The role may perform other duties as assigned.

The position operates under usual office working conditions, with reasonable accommodation available to enable people with disabilities to perform essential job functions. Travel within or outside the state is required. The role is exempt from the Fair Labor Standards Act overtime provisions. Arete describes itself as a growing company with a dedicated team and offers competitive salaries and fully paid benefits.

Requirements

• Bachelor’s degree in Information Security, Computer Science, Digital Forensics, Cyber Security, or a related field and 4+ years of incident response or digital forensics experience; alternatively, a Master’s or advanced degree and 3+ years of related experience.
• Possess two or more of the following certifications: Security+, Network+, SANS GCED, GCIH, GCFE, GCFA, CEH, CHFI, or EnCe.
• Thorough knowledge of Windows disk, Unix or Linux disk, and memory forensics.
• Knowledge of Network Security Monitoring (NSM), network traffic analysis, and log analysis.
• Experience and understanding of enterprise security controls.
• Experience with EnCase, Axiom, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, Wireshark, TCPDump, and open-source forensic tools.
• Ability to establish priorities, work independently, and proceed with objectives with minimal supervision.
• Strong problem-solving and critical-thinking skills to identify and resolve compliance-related issues effectively.
• Excellent verbal and written communication skills to prepare clear, concise reports and collaborate effectively with cross-functional teams.
• Proficiency with Microsoft Suite products.
• No physical exertion is required; the listed physical-demand description also specifies light work involving exerting up to 20 pounds occasionally and/or up to 10 pounds as frequently as needed to move objects.
• Travel within or outside of the state.

Nice To Haves

• Experience delivering technical findings to a non-technical audience.
• Experience leading teams of analysts.
• Ability to provide findings in a confident, factual manner.
• Knowledge and experience handling PII, PHI, sensitive, confidential, and proprietary datasets.
• Experience with cyber insurance investigations.

Responsibilities

• Lead forensic analysis in support of the Forensic lead on ransomware and compromise investigations.
• Work with tiger team analysts to analyze forensic artifacts, including operating system artifacts and recovery of deleted items across Windows, Linux, and Mac, and perform RAM/memory forensics.
• Analyze network and operating-system log files, including Windows Event logs, Unified Audit Logs, firewall logs, and VPN logs.
• Work with the Security Operations Center to use alerts and data from existing and deployed Endpoint Detection and Response solutions to identify indicators of compromise and relevant tactics, techniques, and procedures.
• Prepare forensic findings and updates as clear, concise narratives outlining the timeline of events, adapting delivery to the audience and its technical capabilities.
• Use incident-mapping frameworks such as MITRE ATT&CK and the Lockheed Martin Cyber Kill Chain to contextualize indicators of compromise and develop attack maps.
• Draft incident and investigative updates, reports, and appendices under the explicit direction of counsel and partners, using standard report templates.
• Peer review reports written by team members.
• Deliver the forensic investigations plan and work with the lead to manage analysis timelines, delivery, and execution across projects.
• Perform other duties as assigned by management.

Benefits

• Competitive salaries.
• Fully paid medical and dental benefits.
• Life and disability insurance.
• 401(k).
• Opportunity to work with the latest developments in the fast-growing cybersecurity industry.
• Great pay and benefits.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior