Digital Forensic Analyst (DFIR)

Job Summary

Greetings from GRM Technologies!!!

Role Summary

The Digital Forensic Analyst is responsible for conducting forensically sound acquisition, preservation, examination, and analysis of digital evidence across endpoints, servers, mobile devices, and cloud workloads. The role supports incident response investigations, e. Discovery/legal matters (where applicable), and internal investigations, producing clear, defensible findings and reports suitable for management, legal, and regulatory stakeholders.

Key Responsibilities

Digital Forensics & Evidence Handling Perform forensically sound evidence acquisition (disk, memory, mobile, and cloud artifacts) using validated tools and documented procedures. Maintain strict chain-of-custody and evidence integrity (hashing/verification, secure storage, access logs). Conduct timeline analysis, user activity reconstruction, and artifact correlation (registry, event logs, browser, email, file system metadata).

Execute malware triage and basic reverse engineering support (as needed) to determine behavior and scope. Support litigation hold, e. Discovery support, and evidence packaging in coordination with Legal/HR (as applicable). Reporting & Stakeholder Management Produce investigation reports with executive summaries, technical details, evidence references, and defensible conclusions.

Present findings to technical and non-technical stakeholders; support audit/regulatory requests where applicable. Contribute to and improve DFIR playbooks, SOPs, and lab/tooling procedures.

Required Skills

& Experience 3+ years (or as required) hands-on experience in digital forensics and/or incident response (DFIR). Strong understanding of Windows internals (event logs, registry, artifacts), with working knowledge of Linux/macOS artifacts. Proficiency in forensic acquisition and analysis workflows (disk, memory, and log analysis).

Experience analyzing network evidence (PCAP) and common protocols; familiarity with intrusion and exfiltration patterns. Strong documentation skills and ability to write clear, court/ audit-ready reports. Knowledge of evidence handling standards and best practices (integrity, chain-of-custody, repeatability). Technical Tooling (Preferred) Forensic suites: En.

Case, FTK/FTK Imager, X-Ways, Autopsy/Sleuth Kit Memory forensics: Volatility / Rekall Endpoint & IR: KAPE, Velociraptor, Sysinternals, EDR platforms (Microsoft Defender for Endpoint/Crowd. Strike/Sentinel. One) Network analysis: Wireshark, Zeek, tcpdump SIEM: Splunk, Microsoft Sentinel, QRadar, Elastic Mobile forensics: Cellebrite / Oxygen Forensics / Magnet AXIOM (if in scope Qualifications (Preferred) Bachelor’s degree in Computer Science, Cybersecurity, Digital Forensics, or equivalent experience.

Relevant certifications (one or more): GCFA, GCIH, GNFA, EnCE, ACE, CHFI, CFCE, MCFE, or equivalent. Behavioral Competencies High integrity, discretion, and confidentiality with sensitive investigations. Strong analytical thinking and hypothesis-driven investigation approach. Calm under pressure; able to manage multiple cases with competing priorities.

Collaborative mindset and strong communication across Security, IT, Legal, and HR. What Success Looks Like Evidence is collected and handled with defensible rigor and complete chain-of-custody. Investigations are completed efficiently with clear root-cause and impact assessment. Reports are accurate, structured, and actionable for both technical teams and leadership.

DFIR processes and detection capabilities continuously improve based on learnings.