Manager DFIR

Stroz Friedberg   •  

Los Angeles, CA

Industry: Security Services


Less than 5 years

Posted 372 days ago

Position Overview

As Manager, you are expected to bring severalyears'experience in thecybersecurity industry to bear on your casework. You will work at the direction of a Vice President or Managing Director in the unit to scope, coordinate, and provide peerless service on client cases-- which might require analysis of anytechnology used today:mobile devices, laptops and workstations, servers,networkingswitches, IoT devices, or cloud-based accounts andinfrastructure. You will be expected to perform daily tasksassociated withcyber breach response andinvestigations.  As Manager, you areresponsiblefor augmenting and strengthening your personal DFIR skill set, as well as helping develop the skills of the entire DFIR team.  

What you will do… 

Essential Job Functions

  • Support the most complex forensic analyses handled by the firm.
  • Investigate network intrusions and othercybersecurity incidents to determine the cause and extent of the breach. Includes ability to perform host-based and network-based analysis across all major operating systems and network device platforms.
  • Preserve, harvest and analyze data from electronic data sources, including laptop and desktop computers, servers, and mobile devices.
  • Produce high-quality oral and written work product, presenting complex technical matters clearly and concisely.
  • Form and articulate expert opinions based on analysis.
  • Possess the experience, credibility, and integrity to perform as an expert witness.
  • Consult with and take direction from supervisors, engagement managers, and clients regarding case investigation and status.
  • Support the mentorship and technical development of junior Digital Forensics staff.
  • Investigate instances of malicious code and documents to determine attack vectors and payloads.
  • Develop and refine policies and procedures for forensic and malware analyses.
  • Research, develop, and recommend hardware and software needed for incident response and help develop and maintain policies and procedures to analyze digital evidence.
  • Participate in technical meetings and working groups to address issues related to cybersecurity and incident preparedness and ability to create targeted remediation plans for clients who have been compromised.

How you will make an impact… 

Essential to Success

  • Strong work ethic and motivation, with a demonstrated history of ability to lead a team and develop talent. Even stronger analytic, quantitative, and creative problem-solving abilities.
  • Interest in building intellectual capital for the firm by writing blogs, submitting to CFPs, and creating internal tools for analysis.
  • Ability to anticipate and respond to changing priorities and operate effectively in a dynamic, demand-based environment, requiring flexibility and responsiveness to client matters and needs.
  • Strong verbal and written communication skills.
  • Must be able to work collaboratively across agencies and physical locations.
  • Participation in technical meetings and working groups to address issues related to malware security, vulnerabilities, and issues of cybersecurity and preparedness.
  • A high level of professionalism in all areas of performance.
  • A constantly developed DFIR skill set, and proficiency with industry standard tools and practices, through outside training and research.
  • Comfort with intermittent periods of significant travel, evening and weekend hours.

Functional Expertise

  • GCFE, GCIH, CCE, EnCE or equivalent digitalforensics / incident response certification.
  • Deep experience with most common operating systems (Windows, macOS, Linux, iOS, Android) and their file systems (ext3/4, HFS+, APFS, NTFS, exFAT, etc.).
  • Proficiency with industry-standard DFIR toolsets, including X-Ways, EnCase, Axiom/IEF, Cellebrite, FTK, Pstools and Volatility.
  • Proficiency with database querying and analysis.
  • Experience with cloud infrastructures for the enterprise, such as Amazon Web Services, G Suite, Office 365, and Azure.
  • Experience with conducting log analysis of WindowsEvent Logs, Apache, IIS, and firewall logs.
  • Ability to conduct basic malware analysis.
  • Experience with command line tools (grep, sed, awk, powershell), python, and other programming languages.
  • Familiarity with computer system hardware and software installation and troubleshooting.
  • Well-developed analytic, qualitative, and quantitative reasoning skills and demonstrated creative problem solving abilities.
  • Strong shell, C, C++ and/or Java programming skills and proficiency in Assemblerlanguages a plus.
  • Proficiency with MS Office Applications, and familiarity with Windows, Macintosh and Linux operating systems.

Education Required

Bachelor’s degreerequired. Approximately 3-7 years or more of sustained excellence in digitalforensics, incident response, or applicable technical field.