Deputy Manager - DFIR Tools & Technologies

• Operate and maintain DFIR toolsets including forensic imaging, memory analysis, and network packet capture solutions
• Support incident response teams during breach investigations by preparing and executing data acquisition tasks (disks, memory, logs)
• Perform triage and basic analysis of forensic artifacts under supervision of senior investigators
• Assist in correlating forensic data from EDR/XDR platforms, SIEM tools, and OT network monitoring systems
• Conduct forensic evidence handling and documentation in accordance with chain of custody standards
• Participate in red/blue/purple team exercises, cyber drills, and readiness testing
• Contribute to the setup and tuning of DFIR tools including lab environments and virtual sandboxes
• Maintain tool integrations, script automation where required, and ensure operational availability of forensic toolkits
• Stay updated with new forensic tool capabilities and cyberattack techniques relevant to OT/IT

Technical Skills & Tools:

• Working knowledge of tools like:
  • Disk & Memory Forensics: FTK Imager, Magnet AXIOM, Autopsy, Volatility
  • Network Analysis: Wireshark, tcpdump
  • Log & Endpoint Analysis: CrowdStrike, SentinelOne, Sysmon, ELK Stack
  • Cloud Forensics: AWS CloudTrail, Azure Monitor (preferred)
• Familiarity with MITRE ATT&CK framework, IOC analysis, and basic scripting (Python, Bash, PowerShell)
• Exposure to OT/ICS protocol logs such as Modbus, DNP3, or OPC is a strong advantage

Qualifications & Certifications:

• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or related field
• Certifications preferred: CHFI, GCFA, GCFE, or equivalent (can be ongoing)
• 5 + years of experience in cybersecurity, with at least 2 years in DFIR or SOC operations with forensic exposure

Personality Traits:

• Highly analytical with strong attention to detail
• Eager to learn and take on challenging investigative assignments
• Reliable team player with excellent written documentation skills
• Comfortable working in sensitive and time-critical incident environments