Incident Response and Forensics Officer

Job Summary: The Incident Response and Forensics Officer cybersecurity incident response and digital forensics by detecting, analyzing, and responding to security incidents such as malware, unauthorized access, and data breaches. It conducts forensic investigations, collects and preserves digital evidence, and analyzes logs, network traffic, and system artifacts to determine incident scope and impact. The position follows established incident response playbooks, documents findings, and collaborates with internal teams and external stakeholders to contain and remediate threats. It also contributes to continuous improvement through threat monitoring, post‑incident reviews, and enhancement of incident response procedures.

Duties And Responsibilities

• Assist in the detection, analysis, and response to security incidents, including malware infections, unauthorized access attempts, and data breaches.
• Follow established incident response procedures and playbooks to contain, eradicate, and recover from security incidents in a timely and effective manner.
• Collect and analyze digital evidence using forensic tools and techniques to determine the scope and impact of security incidents.
• Conduct forensic investigations on digital devices, including computers, servers, mobile devices, and network appliances, to identify indicators of compromise and malicious activity.
• Document findings and maintain detailed records of forensic investigations, including chain of custody documentation and evidence preservation procedures.
• Collaborate with internal teams and external stakeholders to coordinate incident response efforts and share threat intelligence information.
• Stay updated on emerging cybersecurity threats, vulnerabilities, and attack techniques to enhance incident detection and response capabilities.
• Provide technical support and expertise during incident response activities, including the analysis of network traffic, log files, and memory dumps.
• Assist in the development and maintenance of incident response plans, procedures, and documentation.
• Participate in post-incident reviews and lessons learned sessions to identify areas for improvement and enhance incident response procedures.
• Maintain confidentiality and integrity of digital evidence throughout the forensic investigation process.
  
  

Qualifications

• Graduate of 4-years and bachelor's degree in computer science, Information Security, Digital Forensics, or a related field.
• Relevant certifications such as GIAC Certified Incident Handler (GCIH), Certified Computer Examiner (CCE), or similar certifications preferred.
  
  

Required Skills

• Demonstrated experience in incident response and digital forensics, preferably in a cybersecurity or IT security role.
• Knowledge of incident response methodologies, forensic techniques, and tools, such as network analysis tools, memory forensics, and disk imaging software.
• Familiarity with cybersecurity threats, vulnerabilities, and attack vectors.
• Proficiency in conducting forensic investigations across various platforms, including Windows, Linux, and cloud environments.
• Strong analytical and problem-solving skills, with the ability to analyze complex technical data and communicate findings effectively.
• Attention to detail and ability to follow established procedures and protocols.
• Effective communication and collaboration skills, with the ability to work well in a team environment.
• Ability to work under pressure and handle multiple tasks simultaneously.