Digital Forensics Lead - USDS

About TikTok U.S. Data Security
TikTok is the leading destination for short-form mobile video. Our mission is to inspire creativity and bring joy. U.S. Data Security (“USDS”) is a subsidiary of TikTok in the U.S. This new, security-first division was created to bring heightened focus and governance to our data protection policies and content assurance protocols to keep U.S. users safe. Our focus is on providing oversight and protection of the TikTok platform and U.S. user data, so millions of Americans can continue turning to TikTok to learn something new, earn a living, express themselves creatively, or be entertained. The teams within USDS that deliver on this commitment daily span across Trust & Safety, Security & Privacy, Engineering, User & Product Ops, Corporate Functions and more.

Why Join Us
Creation is the core of TikTok's purpose. Our platform is built to help imaginations thrive. This is doubly true of the teams that make TikTok possible.
Together, we inspire creativity and bring joy - a mission we all believe in and aim towards achieving every day.
To us, every challenge, no matter how difficult, is an opportunity; to learn, to innovate, and to grow as one team. Status quo? Never. Courage? Always.
At TikTok, we create together and grow together. That's how we drive impact - for ourselves, our company, and the communities we serve.
Join us.

In order to enhance collaboration and cross-functional partnerships, among other things, at this time, our organization follows a hybrid work schedule that requires employees to work in the office 3 days a week, or as directed by their manager/department. We regularly review our hybrid work model, and the specific requirements may change at any time.

Team Intro
The TDR department in TikTok USDS is primarily responsible for threat detection, intelligence, incident response, and forensics. The TDR team in comprised of technical security practitioners, developers, and DFIR experts who work to protect trust in TikTok and our US users' data.

We are seeking a Digital Forensics Lead to join our Forensics & Litigation team. The analyst will partner with internal stakeholders, such as Legal, HR, Ethics, Investigations, and Insider Risk, to support investigations and provide technical expertise. The role will perform forensic preservation of relevant devices and data, respond to incidents, and perform a detailed analysis of systems and data. The role will require an individual able to apply forensic concepts and industry best-practice in the preservation and analysis of newly developed technologies engineered internally at the company.
Responsibilities
- Preserve network and host-based digital evidence in an industry-accepted and forensically sound manner that would be admissible in court proceedings.
- Coordinate digital forensics analysis on large-scale matters.
- Communicate technical events and analysis to both technical and non-technical audiences.
- Perform Apple macOS host-based forensics, including the analysis of user events, the APFS/HFS+ file system, internal services, default applications, and relevant logs.
- Perform Microsoft Windows host-based analysis using both Windows and Linux-based forensic tools.
- Perform analysis of Linux servers, including user events, daemons, security logs, and cron jobs.
- Perform acquisitions and analysis of Apple iOS and Android mobile devices.
- Perform acquisitions and analysis of cloud platforms, such as Microsoft Azure, Amazon Web Services, GCP, and/or others.
- Write detailed forensic reports for investigations.
- Maintain digital forensics equipment and lab environment