Senior Engineer Network Forensics & Incident Response

Verizon • Southlake, TX

2d • Hybrid

About The Position

Verizon’s N&T Network Security team is seeking a Senior Engineer to serve as the technical lead for network digital forensics and incident response (DFIR) across the Network Security Defense portfolio. The Defense organization owns the security lifecycle and effectiveness of the Core, Edge, and Access networks and the systems and network functions within N&T. The role leads technical investigations and response during major security events, while working with Defense teams to improve network visibility and forensic readiness.

The position involves forensic collection and analysis across varied network infrastructure, incident response leadership, network telemetry and memory analysis, threat hunting, YARA rule engineering, and automation of forensic workflows. The engineer will develop and refine DFIR playbooks and produce investigation reports covering attack timelines, root causes, evidence, impacts, and technical remediation recommendations. The role may be based at any US-based Verizon hub location. It is hybrid, with a defined work location, work from home, and at least three days per week in the office; the manager sets the location. Scheduled weekly hours are 40.

Requirements

• Bachelor’s degree or four or more years of relevant work experience.
• Four or more years of relevant experience in digital forensics, network security engineering, or incident response, demonstrated through work experience, military experience, or specialized training.
• Deep experience with SIEM and data analysis platforms such as Splunk or ELK.
• Strong proficiency with forensic acquisition and analysis suites such as EnCase, FTK, Volatility, X-Ways, SANS SIFT, or KAPE.
• Expert knowledge of core network protocols, including TCP/IP, BGP, OSPF, DNS, TLS, and HTTP/S, and telemetry formats including NetFlow, IPFIX, and syslog.

Nice To Haves

• Industry-recognized DFIR certification such as GNFA, GCFA, GCIH, or CCE.
• Experience performing forensics on 4G/5G wireless network functions, carrier-grade IP networks, or virtualization platforms such as Kubernetes, OpenStack, or KVM.
• Proficiency in Python, PowerShell, or Bash for forensic artifact collection and processing.
• Knowledge of the MITRE ATT&CK framework and enterprise threat intelligence integration into forensic workflows.
• Effective written, interpersonal, and verbal communication skills, including the ability to explain complex forensic findings to technical and non-technical audiences.
• Demonstrated technical leadership leading incident response during major cybersecurity incidents.
• Ability to work with diverse stakeholders, including technical engineering teams, business owners, and executives.
• Strong leadership and mentoring abilities, including experience guiding and developing teams.
• Proven ability to manage and deliver results under high-pressure security incident scenarios.

Responsibilities

• Collect, preserve, and analyze forensic evidence across heterogeneous network infrastructure, including edge routers, switches, cloud environments, and specialized network functions.
• Lead technical response during major security incidents, driving containment, root-cause analysis, threat eradication, and network recovery.
• Analyze PCAP, NetFlow/IPFIX, firewall logs, and router or switch artifacts to trace adversary lateral movement and data exfiltration.
• Analyze memory dumps, volatile network state, process execution artifacts, and compromised system state to identify malware execution, persistence, and lateral movement.
• Architect, author, and maintain custom YARA rules for memory analysis, file carving, binary inspection, and continuous matching of endpoint and network artifacts.
• Conduct proactive threat hunting, dissect APT tactics, techniques, and procedures, extract IOCs, and turn forensic findings into actionable detections.
• Automate artifact collection, evidence ingestion, and triage workflows through scripting and tooling.
• Develop and refine DFIR playbooks and runbooks for high-impact incidents, including state-sponsored intrusions, ransomware, supply-chain compromises, and DDoS events.
• Produce forensic investigation reports documenting attack timelines, root cause, evidence analysis, impact assessments, and technical remediation recommendations.

Benefits

• Medical, dental, and vision benefit options
• Short- and long-term disability insurance
• Basic and supplemental life insurance
• AD&D insurance
• Identity theft protection
• Pet insurance
• Group home and auto insurance
• Matched 401(k) savings plan
• Up to 8 company-paid holidays per year
• Up to 6 personal days per year
• Paid parental leave
• Adoption assistance
• Tuition assistance
• Other incentives
• Potential premium pay, including overtime, shift differential, holiday pay, and allowances
• Up to 15 days of vacation per year for newly hired employees, increasing with additional service
• Incentive-based compensation with potential to earn more

What This Job Offers

• Job Type: Full-time
• Career Level: Senior