Senior DFIR Examiner

Soteria - Security Solutions & Advisory•Charleston, SC

8h•$110,000 - $160,000•Remote

About The Position

At Soteria, incident response professionals work directly with clients to help them recover from incidents quickly and effectively. The team guides clients through difficult situations and continues its partnership after an incident to help implement changes that prevent future incidents. The Senior DFIR Examiner leads and participates in incident response and data breach investigations, oversees engagements and DFIR processes, coordinates teammates and resources, and delivers findings and recommendations to clients. The role also develops team capabilities and tooling, mentors colleagues, collaborates with the managed detection and response team, and contributes as a DFIR subject matter expert to company initiatives. This is a fully remote, client-facing position with no mandatory travel; elective travel to industry conferences and training events is possible.

Requirements

At least 5 years of digital forensics, incident response, or other relevant experience.
Experience investigating and understanding techniques related to network breaches, business email compromise (BEC), and ransomware incidents.
Ability to evaluate triage data and artifacts, detect indicators of compromise (IOCs), and identify suspicious activity.
Experience leading complicated engagements, including scoping, client interaction, and technical execution.
Strong leadership and crisis management skills.
Strong written and verbal communication skills.
Working knowledge of Windows, Linux, Unix, and macOS forensics.
Proficiency in analyzing and interpreting logs from diverse sources.
Knowledge of acquiring and analyzing forensic data from physical and virtual systems.
Familiarity with networking concepts, protocols, and architectures.
Experience with disk forensics tools such as Axiom and FTK.
Experience with SIEM tools for searching and extracting data relevant to incident investigations.
Scripting experience to facilitate investigations and remediation efforts.
Ability to communicate findings to technical and non-technical clients.
Ability to deliver detailed written reports at the conclusion of every client engagement.
Ability to participate in an on-call rotation and work weekends and after hours when needed.

Responsibilities

Advise and guide clients through incident response and recovery.
Lead and participate in security incident and data breach investigations, including triaging, collecting, and analyzing forensic data to determine incident scope and severity.
Lead incident response engagements and own multiple DFIR processes and procedures to improve team capabilities and deliver work on time and in line with client expectations.
Coordinate resources and teammates to deliver accurate engagements on time, tailored to each client's response needs.
Identify and resolve gaps in team capabilities and tooling to support investigations of new and unique threats.
Document and present findings and recommendations professionally to clients.
Maintain client relationships after engagements and advise on longer-term remediation.
Maintain competence in security trends, technologies, and practices.
Work with the managed detection and response team to improve detection capabilities.
Identify and train DART team members, mentoring consultants and analysts.
Participate in company-wide initiatives as a DFIR subject matter expert.
Create new capabilities for client delivery and help advance the team.
Participate in an on-call rotation and be available for weekend and after-hours work when needed.