Senior Incident Response & Digital Forensics Analyst

Bloomberg•New York, NY

1d•$190,000 - $260,000•Onsite

About The Position

Bloomberg’s Cyber Security Operations Center (CSOC) protects the organization by identifying, investigating, and responding to cyber threats. Working closely with Engineering, Legal, Compliance, and other teams across Bloomberg, CSOC provides security monitoring, incident response, threat hunting, and forensic expertise across a complex global technology environment. As a Senior Incident Response & Digital Forensics Analyst within the Threat Hunting, Intelligence & Incident Response (THIR) team, you will lead the technical investigation of our most complex security incidents and escalations. You will take ambiguous events where the answer is not immediately apparent and drive them to a defensible conclusion. This includes analyzing host, memory, network, and log evidence; acquiring and examining forensic images; investigating suspicious binaries; and reconstructing attacker activity to determine what happened, how it happened, and the extent of impact. During significant incidents, you will help establish ground truth quickly, maintain technical ownership of the investigation, and work with stakeholders across Bloomberg to support an effective response. This role also carries an important leadership expectation: raising the analytical capability of the wider team. Through hands-on mentoring, incident pairing, playbooks, procedures, and structured knowledge sharing, you will help build deeper expertise in areas such as malware analysis, memory forensics, and log-based threat hunting. You will also help shape Bloomberg’s forensic capabilities by contributing to tooling, workflows, investigative standards, and the conversion of lessons learned from incidents into repeatable processes and durable detection coverage.

Requirements

Substantial hands-on experience leading security incident investigations end to end, from initial signal through root-cause analysis and written conclusion.
Strong practical experience with disk and memory forensics across Windows and Linux, including evidence acquisition and analysis.
Demonstrated malware analysis experience, including static and dynamic analysis, safe detonation, and extraction of useful observables for detection and threat hunting.
Strong knowledge of operating-system internals across Windows, Linux, and macOS.
Strong understanding of networking fundamentals, including TCP/IP, DNS, routing, and network evidence analysis.
Deep hands-on experience investigating large datasets using Splunk or a comparable enterprise search and log-analysis platform.
Experience using endpoint and network telemetry to determine attacker behavior and identify additional evidence when existing visibility is insufficient.
Programming or scripting capability in any language; Python is commonly used within the team.
The ability to investigate difficult and unfamiliar problems independently while knowing when to involve others or seek additional expertise.
Strong written and verbal communication skills, including the ability to explain investigative findings and reasoning clearly.

Nice To Haves

Memory-forensics frameworks such as Volatility and structured forensic acquisition tooling.
Reverse engineering beyond behavioral malware analysis.
Cloud forensics across AWS, Azure, or GCP, including snapshot-based acquisition and investigation.
Threat hunting and knowledge of attacker tools, techniques, and procedures used against enterprise environments.
CrowdStrike Falcon, particularly Real Time Response (RTR), for remote artifact and evidence collection.
Humio / LogScale or other large-scale log-analysis platforms.
Endpoint telemetry and EDR technologies such as osquery, Sysmon, Carbon Black, or Tanium.
Network security monitoring technologies such as Zeek, Suricata, Snort, NetWitness, packet capture, or network IDS.
Working with detection engineering teams to translate investigative findings into sustainable detection coverage.
Git, Jira, Jupyter notebooks, or similar development and collaboration tools.
Relevant certifications such as GCFA, GCFE, GREM, or GNFA.
Experience applying mainstream commercial AI platforms to security or analytical workflows.

Responsibilities

Lead the technical investigation of complex security incidents and escalations.
Analyze host, memory, network, and log evidence.
Acquire and examine forensic images.
Investigate suspicious binaries.
Reconstruct attacker activity to determine the cause, method, and impact of security incidents.
Establish ground truth quickly during significant incidents.
Maintain technical ownership of investigations.
Work with stakeholders to support effective incident response.
Raise the analytical capability of the wider team through mentoring, incident pairing, playbooks, procedures, and knowledge sharing.
Contribute to tooling, workflows, and investigative standards.
Convert lessons learned from incidents into repeatable processes and durable detection coverage.