DFIR Analyst

The role

The DFIR Analyst will conduct EDR-driven incident response and forensic analysis across endpoint, network, cloud, and SaaS environments. This role involves acquiring forensic evidence, supporting malware analysis, and providing technical documentation for stakeholders.

What you will do

• Conduct EDR-driven incident response and vendor-agnostic forensic analysis.
• Acquire and preserve forensic evidence from endpoint, network, and cloud sources.
• Support malware and memory analysis tasks.
• Support incident containment actions and prepare security hardening recommendations.
• Maintain thorough case documentation throughout each investigation.
• Contribute to customer-facing status updates and formal investigative reports.
• Follow standard operating procedures and escalate questions as needed.
• Maintain awareness of emerging threats and attacker techniques.
• Be responsive to high-pressure triage and analysis during large-scale incidents.
• Support handovers of investigations across regions as needed.

Required qualifications

• Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science, or a related technical field, or equivalent practical self-study.
• 2 or more years of hands-on experience in digital forensics, incident response, or threat hunting.
• Comfort analyzing Windows environments and forensic artifacts.
• Foundational understanding of forensic methodologies, evidence handling, acquisition techniques, and chain-of-custody procedures.
• Experience with forensic tools such as X-Ways Forensics, Axiom, and FTK.
• Experience with EDR/XDR platforms and SIEMs.
• Working knowledge of network protocols and network-based forensic analysis.
• Scripting and automation capabilities.
• Strong verbal and written communication.
• Ability to perform technical investigations under pressure in high-stakes, time-sensitive situations.

Nice to have

• Experience in a consulting or services delivery environment.
• SentinelOne EDR/XDR platform experience.
• Knowledge of Linux and macOS forensic analysis.
• Exposure to cloud environments (AWS, Azure, GCP).
• Exposure to memory analysis.

Benefits

• Restricted Stock Units (RSUs)
• Employee Stock Purchase Plan (ESPP)
• Competitive leave benefits
• Gender-neutral parental leave
• Medical and insurance benefits
• Employee Assistance Program (EAP)
• Global home office allowance
• Internet and mobile phone allowance
• Flexible benefits allowance

About the company

SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Their AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems.