About the Role
We are looking for a seasoned Digital Forensics professional with deep, hands-on experience in forensic investigation, incident analysis, and evidence handling. This person will function as a strong individual contributor owning investigations end-to-end. Key Responsibilities: Forensic Investigation- • Lead and execute end-to-end digital forensic investigations across host-based and network-based environments. • Perform disk, memory, and log forensics to determine root cause, attack vectors, and scope of compromise. • Conduct malware analysis — static and dynamic — to characterise attacker tooling and behaviour. • Reconstruct event timelines across multiple data sources: endpoint, network, cloud logs, and SIEM telemetry. • Preserve and manage digital evidence in accordance with forensic best practices and chain-of-custody requirements. SIEM & EDR-Driven Analysis- • Leverage SIEM platforms (QRadar, Splunk, Sentinel, ArcSight) as a primary investigation tool- mandatory proficiency. • Use EDR/XDR platforms (Cortex XDR, Microsoft Defender, CrowdStrike, or equivalent) for deep endpoint telemetry analysis — mandatory proficiency. • Correlate signals across SIEM and EDR to build a complete picture of attacker activity Reporting & Documentation- • Produce structured, audit-ready forensic investigation reports for both technical peers and executive stakeholders. • Document investigation methodologies, findings, indicators of compromise (IOCs), and remediation recommendations with precision. • Develop and maintain investigation playbooks, forensic SOPs, and evidence-handling procedures. Required Skills & Technical Expertise: Mandatory — SIEM & EDR- • Hands-on proficiency with one or more SIEM platforms: QRadar, Splunk, Microsoft Sentinel, or ArcSight. • Hands-on proficiency with one or more EDR/XDR platforms: Cortex XDR, Microsoft Defender for Endpoint, CrowdStrike Falcon, or equivalent. • Ability to write and tune detection queries, hunt across telemetry, and extract forensic value from platform data. Forensic Tools- • Proficiency with industry-standard forensic tooling: EnCase, FTK, or Autopsy • Experience with memory forensics using Volatility or equivalent • Familiarity with Magnet AXIOM is an advantage Technical Fundamentals- • Deep understanding of Windows internals (registry, event logs, artefact locations, NTFS) and Linux forensics. • Experience identifying persistence mechanisms, lateral movement techniques, and command-and-control activity. • Working knowledge of the MITRE ATT&CK framework and adversary TTP mapping. • Ability to perform network forensics: packet analysis, flow data, proxy and firewall log review. Communication- • Strong technical writing skills — capable of producing structured, defensible reports with minimal review. • Comfortable presenting findings to both technical teams and management audiences. Good to Have- • Cloud forensics experience across AWS, Azure, or GCP environments (logs, storage, identity artefacts). • Exposure to digital forensics in regulated industries (BFSI, healthcare, critical infrastructure). • Familiarity with scripting (Python, PowerShell) to automate forensic data collection or parsing.