Specialist, Cybersecurity (Digital Forensics)

Nationwide Mutual Insurance•Columbus, OH

4d•Hybrid

About The Position

Nationwide is seeking a detail-oriented, technically proficient digital forensics professional to join its cybersecurity team. The role conducts digital forensic investigations, analyzes digital evidence, and supports incident response. The position works on a hybrid schedule, reporting to the Columbus, Ohio office two days per week. The specialist investigates security incidents such as data breaches, malware infections, unauthorized access, and intellectual property theft. The role collects, preserves, and analyzes evidence from endpoints, servers, cloud environments, and mobile devices, maintaining chain of custody and complying with legal and regulatory requirements. It uses forensic imaging and analysis methods across Windows, Linux, macOS, and mobile devices; scripting to automate evidence collection and analysis; and logs, network traffic, and datasets to reconstruct timelines and identify root causes. The specialist prepares reports and presents findings to technical and non-technical audiences, including legal, HR, and management, and contributes to forensic processes and playbooks. As part of Cyber Operations, the role also responds to cyber incidents using recognized methodologies, improves detection and prevention, supports vulnerability management, and contributes to incident response, threat hunting, and other proactive cyber activities. The position reports to a Manager, Risk Leader, or above. The role is exempt from overtime eligibility and is performed in a hybrid, normal office environment.

Requirements

At least three years of experience in technology.
Experience with operating systems, networking, desktop support, application development, endpoint security, database management, or information security.
Experience configuring and using Windows and Linux/Unix operating systems.
Proficiency in Python or PowerShell scripting for automation and data analysis.
Experience with forensic imaging and analysis tools.
Strong understanding of file systems and Windows, Linux, and macOS operating systems.
Ability to analyze and interpret large datasets.
Experience in digital evidence collection and preservation and forensic methodologies.
Familiarity with incident response procedures and integration with forensic workflows.
Knowledge of regulatory and compliance requirements related to data security, privacy, and digital evidence.
Strong written and verbal communication skills for reporting and presenting findings.
Action-oriented approach and ability to make decisions and recommendations.
Ability to build partnerships, understand business processes, and set priorities.
Solid communication skills.

Nice To Haves

Understanding of networking concepts and protocols.
Exposure to cloud platforms such as AWS, Azure, or GCP.
Certifications such as GIAC GCFA, GCIH, CEH, EnCE, MCFE, or similar.
Undergraduate studies in cybersecurity, management information systems, engineering, math, computer science, data analytics, or a comparable field or education and experience.
Graduate studies in cybersecurity, computer science, or a related field.
Preferred certifications include CISSP, CCNA, CEH, GCIH, EnCE, GSTRT, GSE, CCSP, AWS Certified Cloud Practitioner, and AZ500.
Insurance or financial services industry knowledge.

Responsibilities

Lead and conduct digital forensic investigations into data breaches, malware infections, unauthorized access, intellectual property theft, and other security incidents.
Collect, preserve, and analyze digital evidence from endpoints, servers, cloud environments, and mobile devices while maintaining chain of custody and meeting legal and regulatory requirements.
Perform forensic imaging and analysis of Windows, Linux, macOS, and mobile devices using industry-standard tools and methodologies.
Develop and execute Python or PowerShell scripts to automate evidence collection, data parsing, and artifact extraction.
Analyze logs, network traffic, and large datasets to reconstruct timelines and identify root causes.
Prepare detailed forensic reports and present findings to technical and non-technical stakeholders, including legal, HR, and management.
Support development and refinement of forensic processes and playbooks.
Respond to cyber incidents using recognized methodologies such as PICERL.
Improve cybersecurity detection and alerts to help prevent threats.
Apply secure software and systems engineering practices throughout the delivery lifecycle.
Implement automation and orchestration for enrichment and handling of cybersecurity events.
Support vulnerability management and proactively identify vulnerabilities in the environment.
Assist in planning and executing team activities to improve detection and prevention controls.
Participate in proactive cyber activities such as purple teaming, threat hunting, and red teaming, and expand awareness of the MITRE ATT&CK framework.
Identify critical log sources and system events for creating and tuning cybersecurity detections.
Maintain awareness of the cyber threat landscape and help evaluate, enrich, and disseminate information for protective action.
Perform other responsibilities as assigned.

Benefits

Medical insurance
Dental insurance
Vision insurance
Life insurance
Short- and long-term disability coverage
Paid time off: at least 18 days per full calendar year for newly hired associates, prorated quarterly based on hire date
Nine paid holidays
Eight hours of Lifetime paid time off
Eight hours of Unity Day paid time off
401(k) with company match
Company-paid pension plan
Business casual attire