DFIR / Incident Response Specialist

Arobas Personnel is looking for an experienced DFIR / Incident Response Specialist for a contract opportunity with one of our clients. The specialist will support the Digital Forensics & Incident Response (DFIR) team in investigating and responding to security incidents, conducting forensic analysis, and supporting containment, eradication, and recovery activities.

Key Responsibilities

🔹 Investigate and respond to security incidents across the organization’s environment 🔹 Triage and investigate security alerts escalated by the SOC into confirmed incidents 🔹 Perform digital forensic analysis on compromised or suspicious systems, including endpoint, network, memory, and cloud environments 🔹 Establish root cause, scope, and incident timelines through forensic analysis 🔹 Collect and preserve forensic evidence following chain-of-custody procedures 🔹 Identify Indicators of Compromise (IOCs) and adversary TTPs and share findings with CTI and Detection Engineering teams 🔹 Support containment, eradication, and recovery activities in coordination with IT and infrastructure teams 🔹 Draft incident reports and post-incident reviews , including root cause analysis and remediation recommendations 🔹 Contribute to and refine Incident Response playbooks and runbooks 🔹 Collaborate with SOC, CTI, Detection Engineering, and Red Team stakeholders on incident handling and lessons learned Key Deliverables : 🔹 Completed incident investigations with documented timelines, root cause, and impact assessments 🔹 Forensic evidence packages , including disk, memory, network, and cloud artifacts, preserved according to chain-of-custody standards 🔹 IOC and TTP reporting to support CTI and Detection Engineering improvements 🔹 Post-incident reports including remediation and lessons-learned recommendations 🔹 Updated and refined Incident Response playbooks and runbooks Key Expertise : 🔹 Digital Forensics & Incident Response (DFIR) 🔹 Security incident investigation and response 🔹 Endpoint, network, memory, and cloud forensic analysis 🔹 Forensic evidence collection and preservation 🔹 IOC and TTP identification 🔹 Incident containment, eradication, and recovery 🔹 Incident reporting and root cause analysis