Digital Forensics and Incident Response (DFIR) Analyst

Stack

Responsibilities

• ▹Lead enterprise incident response and cyber crisis engagements from detection through recovery
• ▹Direct host, network, cloud, identity and SaaS investigations across Windows, Linux, macOS, Microsoft 365, AWS, Azure and hybrid environments
• ▹Perform advanced threat hunting and compromise assessments using SIEM, EDR, forensic and threat intelligence platforms
• ▹Develop containment, eradication and remediation strategies aligned to business risk
• ▹Produce executive briefings, technical reports and post-incident reviews
• ▹Partner with legal, compliance, privacy and audit stakeholders
• ▹Drive adoption of AI-assisted workflows
• ▹Support the 24/7 on-call rotation

Requirements

• ▹5+ years in incident response, DFIR, security operations, consulting or related cybersecurity disciplines
• ▹Experience leading major cyber incidents such as ransomware, business email compromise, insider threats, cloud compromise, supply chain attacks or APTs
• ▹Strong digital forensics capability with industry-standard tools
• ▹Experience with Splunk, Microsoft Defender, CrowdStrike Falcon, ServiceNow SIR and cloud security technologies
• ▹Knowledge of network protocols, detection engineering, log analytics and threat hunting methodologies
• ▹Forensic tools (FTK, Encase, X-Ways, Magnet Axiom, SIFT or other) experience is mandatory
• ▹Excellent communication for technical and executive audiences

Nice to have

• ▹Industry certifications such as GCFA, GCFE, GCIH, GCIA, CISSP, CISM, Azure Security Engineer, AWS Security Specialty (not mandatory)

Soft skills

About the company

RGA is a Fortune 200 company and the only global reinsurance company focused primarily on life- and health-related solutions.