Senior Investigator Digital Forensics, Incident Response (DFIR)

Accenture•Chicago, IL

19h

About The Position

Accenture Security’s global Cyber Investigation and Forensic Response practice provides around-the-clock incident response services to enterprise customers worldwide. The Senior Investigator is a hands-on technical leader who owns complex digital forensics and incident response investigations, performs deep technical analysis, and communicates findings to clients and stakeholders under pressure. The role leads investigation workstreams involving 20–50 or more systems with minimal oversight, mentors and trains 2–4 investigators across multiple cases, and provides quality assurance on findings before Primary Investigator review. It supports Primary Investigators with technical decisions and investigation strategy, translates strategic direction into tactical work, and communicates with customers, stakeholders, and legal counsel throughout engagements. The position authors comprehensive reports with defensible conclusions, presents findings to clients when appropriate, and supports engagement scoping. Travel may be required and can range from 0% to 100%, depending on business and client needs.

Requirements

Bachelor’s degree or equivalent, with a minimum of 12 years of work experience; applicants with an associate’s degree must have at least 6 years of work experience.
At least 4 years of digital forensics and incident response (DFIR) experience, including demonstrated expertise in complex investigations.
Ability to obtain US security clearances as required by client engagements.
At least 3 years of demonstrated experience in enterprise incident response, digital forensics, and cyber incident investigation processes.
At least 3 years of experience with common DFIR toolsets such as Volatility, X-Ways, FTK, EnCase, and Autopsy.
At least 3 years of experience with Microsoft Windows, GNU/Linux, and macOS operating systems.
At least 3 years of experience in memory forensics and malware analysis.
At least 3 years of experience developing indicators of compromise and deriving attacker tactics, techniques, and procedures.
At least 3 years of experience leading investigation workstreams and mentoring junior team members.
At least 3 years of experience with enterprise environments, Active Directory, and common attack patterns.
At least 3 years of experience with project management, analytical work, and client-facing communication.
At least 3 years of experience solving complex forensic challenges requiring advanced techniques.
At least 3 years of experience threat hunting on endpoints and networks.
At least 3 years of experience producing accurate, defensible, well-documented analysis.
At least 3 years of experience with eradication techniques, monitoring improvements, and protection capabilities.
At least 3 years of experience developing and implementing dynamic remediation plans in conjunction with incident response engagements.
US employment authorization that does not now or in the future require visa sponsorship.

Nice To Haves

Experience with cloud environments such as AWS, Azure, or GCP and cloud-native forensics.
Experience with OT and ICS environments.
Proficiency in scripting and programming languages such as Python, PowerShell, or Bash.
Experience with reverse engineering and sandboxing technologies.
Advanced malware analysis capabilities, including unpacking, deobfuscation, and behavior analysis.
Contributions to open-source DFIR tools or methodologies.
Active participation in the security community through conferences, publications, or training development.
Security certifications such as GCFA, GCFE, GREM, GCIH, CEH, or similar.
Advanced certifications such as SANS 500-level, OSCP, or OSCE.

Responsibilities

Conduct complex forensic analysis, including advanced memory forensics, malware triage, encrypted artifact recovery, and anti-forensics detection.
Perform host and network digital forensics, log analysis, and threat hunting in support of incident response investigations.
Use EDR solutions, cloud platforms, and threat intelligence to identify attacker tactics, techniques, and procedures.
Conduct incident response in cloud, OT, and traditional enterprise environments.
Develop indicators of compromise and contribute to comprehensive attack timelines.
Create automation tools and scripts to improve team efficiency and investigation capabilities.
Mentor and train 2–4 investigators across multiple cases.
Provide quality assurance on investigator findings before Primary Investigator review.
Lead medium to large workstreams involving 20–50 or more systems with minimal oversight.
Support Primary Investigators with technical decision-making and investigation strategy.
Translate strategic investigation direction into tactical tasks for team execution.
Communicate and interface with customers, stakeholders, and legal counsel throughout engagements, both technically and strategically.
Author comprehensive client reports on investigative findings with defensible conclusions.
Present technical findings in client calls when appropriate.
Support Accenture leadership in scoping engagements using innovative, methodical approaches.