This role requires strong technical expertise, sound judgment under pressure, and the ability to communicate clearly with both technical teams and business stakeholders during high-stakes incidents.  

We are especially interested in candidates with hands-on experience applying AI tools to security operations and incident response, as we continue to expand AI-driven detection, triage, and analysis capabilities across the team. 

• Lead investigations into security incidents, including malware infections, data breaches, and advanced persistent threats (APTs) 

• Perform forensic analysis on compromised systems, network traffic, and log data (e.g., WAF, firewall, endpoint, cloud, and application logs) 

• Evaluate, pilot, and integrate AI-based tools (e.g., AI-powered SIEM/XDR triage, anomaly detection, LLM-assisted log analysis and report generation) into the incident response lifecycle 

• Provide timely, accurate incident reports and executive summaries to stakeholders and customers 

• Identify indicators of compromise (IOCs) and threat actor tactics, techniques, and procedures (TTPs), including AI-enabled attack methods. 

• Mentor and guide junior analysts on investigation methodology, best practices, and use of AI-assisted tooling 

• Create and implement improvements to detection, monitoring, and response capabilities, including AI/automation-driven enhancements 

• Maintain awareness of the evolving threat landscape, including emerging vulnerabilities, attack techniques, and AI-related threats (e.g., AI-generated phishing, adversarial ML) 

• Support post-incident reviews and root cause analysis to strengthen organizational security posture 

Required Qualifications 

• 5+ years of experience in incident response and digital forensics 

• Demonstrated experience with AI-related projects or activities in a security context (e.g., deploying or tuning AI-based detection/triage tools, using generative AI/LLMs to accelerate investigations or reporting, building automation that leverages machine learning models) 

• Prior experience working directly with clients/customers during live incident engagements 

• Strong understanding of network protocols, operating systems (Windows/Linux), and cloud environments (AWS, Azure, GCP) 

• Proven experience conducting cloud forensics investigations across major cloud service providers (AWS, Azure, GCP), including: 

• Acquiring and analyzing cloud-native artifacts (VM snapshots/disk images, memory captures, container images, serverless function logs) 

• Analyzing cloud control plane and audit logs (e.g., Azure Activity Log, AWS CloudTrail, GCP Audit Logs) to reconstruct attacker activity and timelines 

• Understanding shared responsibility models and their impact on evidence availability and collection methods 

• Investigating incidents involving cloud storage (e.g., S3 buckets, Azure Blob Storage), managed databases, and Kubernetes/container orchestration environments 

• Working with volatile and ephemeral cloud resources where traditional forensic imaging techniques may not apply 

• Hands-on experience with SIEM platforms, EDR/XDR tools, and log analysis (e.g., Splunk, CrowdStrike, Microsoft Sentinel), including AI-enabled features of these platforms 

• Relevant certifications such as GCIH, GCFA, GNFA, CISSP, CEH, OSCP, or cloud-specific credentials. 

• Familiarity with WAF, load balancer, and application gateway logs (e.g., Azure Application Gateway, Cloudflare, AWS WAF) 

• Solid understanding of the MITRE ATT&CK framework and threat intelligence concepts 

• Experience conducting forensic investigations and chain-of-custody procedures, including in distributed and multi-cloud environments 

• Excellent written and verbal communication skills, with the ability to translate technical findings for non-technical audiences 

• Ability to work under pressure and manage multiple concurrent investigations 

• Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience) 

Preferred Qualifications 

• Experience with scripting/automation (Python, PowerShell) for investigation tasks, including integrating AI libraries or APIs into workflows 

• Practical exposure to concepts such as model training, prompt engineering, or AI governance/risk as applied to cybersecurity 

• Experience with cloud-native security tools and container security 

• Familiarity with cloud-native forensic and incident response tooling (e.g., AWS Detective, Azure Sentinel, Google Chronicle, Magnet AXIOM Cloud)