Senior Investigator Digital Forensics, Incident Response (DFIR)

Accenture•St. Louis, MO

1d•$54,400 - $205,800

About The Position

Accenture Security’s global Cyber Investigation and Forensic Response practice provides around-the-clock incident response to enterprise customers worldwide. The Senior Investigator is a hands-on technical leader who owns complex investigations, brings deep digital forensics, incident response, and threat-analysis expertise to active incidents, and communicates effectively with both technical teams and client leadership. The role performs advanced forensic analysis across cloud, operational technology, and traditional enterprise environments; leads medium-to-large investigation workstreams with minimal oversight; and supports Primary Investigators with technical decisions and strategy. It also mentors and trains investigators, reviews findings for quality, develops automation, and produces defensible client reports and presentations. Travel may be required, varying from 0 to 100% based on business and client needs.

Requirements

Bachelor’s degree or equivalent (minimum 12 years) work experience; with an associate’s degree, at least 6 years of work experience is required.
At least 4 years of digital forensics and incident response (DFIR) experience, with demonstrated expertise in complex investigations.
Ability to obtain US security clearances as required by client engagements.
At least 3 years of demonstrated experience in enterprise incident response, digital forensics, and cyber incident investigation processes.
At least 3 years of demonstrated experience with common DFIR toolsets such as Volatility, X-Ways, FTK, EnCase, and Autopsy.
At least 3 years of demonstrated experience with Microsoft Windows, GNU/Linux, and MacOS operating systems.
At least 3 years of demonstrated experience in memory forensics and malware analysis.
At least 3 years of demonstrated experience developing indicators of compromise and deriving attacker TTPs.
At least 3 years of demonstrated experience leading investigation workstreams and mentoring junior team members.
At least 3 years of demonstrated experience with enterprise environments, Active Directory, and common attack patterns.
At least 3 years of demonstrated experience with project management, analytical, and client-facing communication skills.
At least 3 years of demonstrated experience solving complex forensic challenges that require advanced techniques.
At least 3 years of demonstrated experience threat hunting on endpoints and networks.
At least 3 years of demonstrated experience producing accurate, defensible, well-documented analysis.
At least 3 years of demonstrated experience with eradication techniques, monitoring improvements, and protection capabilities.
At least 3 years of demonstrated experience developing and implementing dynamic remediation plans in conjunction with incident response engagements.

Nice To Haves

Experience with cloud environments (AWS, Azure, GCP) and cloud-native forensics.
Experience with OT and ICS environments.
Proficiency in scripting and programming languages such as Python, PowerShell, and Bash.
Experience with reverse engineering and sandboxing technologies.
Advanced malware analysis capabilities, including unpacking, deobfuscation, and behavior analysis.
Contributions to open-source DFIR tools or methodologies.
Active participation in the security community through conferences, publications, or training development.
Security certifications such as GCFA, GCFE, GREM, GCIH, CEH, or similar.
Advanced certifications such as SANS 500-level, OSCP, or OSCE.

Responsibilities

Conduct complex forensic analysis, including advanced memory forensics, malware triage, encrypted artifact recovery, and anti-forensics detection.
Perform host and network digital forensics, log analysis, and threat hunting in support of incident response investigations.
Use EDR solutions, cloud platforms (AWS, Azure, GCP), and threat intelligence to identify attacker Tactics, Techniques and Procedures (TTPs).
Conduct incident response in cloud, OT, and traditional enterprise environments.
Develop indicators of compromise and contribute to comprehensive attack timelines.
Create automation tools and scripts to improve team efficiency and investigation capabilities.
Mentor and train 2–4 investigators across multiple cases.
Provide quality assurance on investigator findings before Primary Investigator review.
Lead medium-to-large workstreams involving 20–50+ systems with minimal oversight.
Support Primary Investigators with technical decision-making and investigation strategy.
Translate strategic investigation direction into tactical tasks for team execution.
Communicate and interface with customers, stakeholders, and legal counsel throughout the engagement lifecycle, both technically and strategically.
Author comprehensive client reports on investigative findings with defensible conclusions.
Present technical findings in client calls when appropriate.
Support Accenture leadership in scoping engagements using innovative, methodical approaches.