Investigator Jobs

About The Position

Requirements

• Bachelor’s degree or equivalent work experience.
• At least 3 years of experience in DFIR, with demonstrated expertise in complex investigations.
• At least 3 years of experience in cybersecurity consulting and data-oriented development or analysis.
• At least 3 years of experience building tools used by others in professional practice.
• At least 3 years of demonstrated experience with at least one data or development layer: Python, PowerShell, Power BI, Power Apps/Automate, SQL, or a comparable stack.
• At least 3 years of demonstrated experience with common DFIR toolsets such as Volatility, X-Ways, FTK, EnCase, or Autopsy.
• At least 3 years of demonstrated experience with Microsoft Windows, GNU/Linux, and MacOS operating systems.
• At least 3 years of demonstrated experience in memory forensics.
• At least 3 years of demonstrated experience in enterprise environments, Active Directory, and common attack patterns.
• At least 3 years of demonstrated experience in endpoint and network threat hunting.
• At least 3 years of demonstrated experience with recognized incident response lifecycles and frameworks such as SANS, NIST, or MITRE.
• At least 3 years of demonstrated experience producing accurate, defensible, well-documented analysis.
• At least 1 year of demonstrated experience using AI coding assistants and generative tools fluently in everyday development work.
• At least 1 year of demonstrated experience with Azure and cloud-native architectures, and comfort using AI as a development accelerator.
• Must be open and able to travel based on client and project requirements.
• Sponsorship is not available.

Nice To Haves

• Experience with cloud forensics across AWS, Azure, and GCP; OT/ICS experience is a plus.
• Malware analysis capabilities, including unpacking, deobfuscation, behavior analysis, and reverse engineering.
• Experience with AI governance, responsible-use frameworks, or tool validation in security or consulting.

Responsibilities

• Conduct complex forensic investigations, including advanced memory forensics, malware triage, encrypted artifact recovery, and anti-forensics detection.
• Perform host and network digital forensics, log analysis, and threat hunting for incident response engagements.
• Use EDR solutions, cloud platforms, and threat intelligence to identify and document attacker TTPs.
• Participate in incident response across cloud, OT, and traditional enterprise environments.
• Develop indicators of compromise and comprehensive, defensible attack timelines.
• Design and build proprietary investigation tools, automation scripts, and data products to accelerate forensic workflows and improve consistency.
• Translate repeatable investigation processes into functional prototypes using AI-assisted development, low-code platforms, data visualization, and development tools.
• Use generative AI and AI coding assistants fluently to reduce manual effort across triage, analysis, and reporting.
• Govern tools through documentation, version control, onboarding guides, and iteration based on engagement feedback.
• Collaborate with senior practitioners to identify tooling improvements to speed, quality, and scalability.
• Interface with client stakeholders and legal counsel throughout engagements.
• Author comprehensive, defensible written reports on investigative findings.
• Present technical findings and tool outputs on client calls.
• Support leadership in scoping engagements with methodical, innovative approaches.