Prolink-Consulting
Incident Response Lead - 1372561 (JPN)
Lead sophisticated digital forensics and incident response engagements: investigate breaches, perform host/network forensics across all major OSes, conduct malware analysis, give expert testimony, and supervise DFIR staff. Core stack: EnCase, X-Ways, FTK, Volatility, Python, and cloud platforms; fluent English and Japanese required.
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Not specified
- Seniority
- Lead
- Employment
- Not specified
- Experience
- 2+ years
- Category
- Security
- Posted
Skills
Must have
- 8+ years hands-on Incident Response experience plus some digital forensic experience
- 2+ years Incident Response lead experience
- Ability to anticipate and respond to changing priorities in a dynamic, demand-based environment
- Deep experience with Windows, macOS, Linux, iOS, Android and their file systems (ext3/4, HFS+, APFS, NTFS, exFAT)
- Proficiency with forensic toolsets such as X-Ways, EnCase, Axiom/IEF, Cellebrite/UFED, and FTK
- Ability to conduct malware analysis in support of IR engagements
- Proficiency with database querying and analysis
- Knowledge of scripting/programming languages to automate IR processes
- Knowledge of memory analysis techniques including Volatility (Python) or Rekall
- Experience with log analysis: Windows Event Logs, Apache, IIS, firewall logs
- Experience with command line tools (grep, sed, awk, powershell), python, and other languages
- Experience with enterprise cloud infrastructures: AWS, G Suite, Office 365, Azure
- Comfort with intermittent travel, evening and weekend hours
- Strong written and oral communication skills and attention to detail
- Fluency in spoken and written English and Japanese
- Relevant IR certification such as SANS GCFA or GCIH, CREST CPIA or CRIA, or equivalent
Nice to have
- Bachelor's degree in Computer Science, Information Security, Engineering, Digital Forensics or related
- Interest in writing blogs, submitting to CFPs, and crafting internal analysis tools
- Familiarity with mobile device operating systems (iOS and Android)
- Knowledge of computer networking technologies
- Proficiency with C++, C#, Python, or SQL; assembler languages a plus
- Knowledge of penetration testing techniques (SQLi, XSS, RFI/LFI, directory traversal) and tools (Nessus, Nmap, Kali Linux, Burp Suite, SQLMap)
- Participation in technical meetings and working groups on malware and cybersecurity issues
- Continuously developed DFIR skill set through outside training and research
Full description
Responsibilities
- Lead the most sophisticated forensic analyses handled by the firm.
- Investigate network intrusions and other cybersecurity incidents to determine the cause and extent of the breach. Includes ability to perform host-based and network-based analysis across all major operating systems and network device platforms.
- Provide expert testimony in trials, depositions, and other proceedings.
- Supervise other Digital Forensics and Incident Response staff, including coordinating teams of professionals, assuring stellar work product, and assisting with performance reviews and mentorship of cybersecurity professionals.
- Ensure that client matters are staffed adequately and efficiently and that deadlines are met.
- Form and articulate expert opinions based on analysis.
- Draft and conduct peer review of expert reports, affidavits, and other experienced testimony.
Essential Requirements
-
8+ years or more of sustained hands-on excellence in the Incident Response industry along with some digital forensic experience. 2+ years Incident Response lead experience.
- Ability to anticipate and respond to changing priorities and operate effectively in a dynamic, demand-based environment, requiring flexibility and responsiveness to client matters and needs.
- Deep experience with most common operating systems (Windows, macOS, Linux, iOS, Android) and their file systems (ext3/4, HFS+, APFS, NTFS, exFAT, etc.).
-
Proficiency with industry-standard forensic toolsets (i.e. X-Ways, EnCase, Axiom/IEF, Cellebrite/UFED, and FTK).
- Ability to conduct malware analysis in support of incident response engagements.
- Proficiency with database querying and analysis.
- Knowledge of scripting/programming languages to assist in automating some IR processes.
-
Knowledge of memory analysis techniques including the use of volatility (Python), rekall (Python) , or other tools.
- Experience with conducting log analysis of various types of logs, including Windows Event Logs, Apache, IIS, and firewall logs.
-
Experience with command line tools (grep, sed, awk, powershell), python, and other programming languages.
- Experience with cloud infrastructures for the enterprise, such as Amazon Web Services, G Suite, Office 365, and Azure (Microsoft)