Senior Forensics Analyst

ABM is currently seeking a highly motivated and experienced Senior Forensics Analyst. The Senior Forensics Analyst is a senior technical member of the information security team responsible for leading forensic examinations through collection, processing, analysis and preservation of digital data. This role serves as a subject matter expert in digital forensics and works closely with incident responders, security operations center (SOC) staff, threat hunters, and host and network engineering colleagues.

The Senior Forensics Analyst examines digital data and events from computer memory and storage (Windows, Linux, macOS), mobile devices, electronic communications, malware samples and data transmissions across the enterprise. This role provides strategic guidance on forensic processes, mentors junior analysts, and communicates complex technical findings to executive leadership, legal counsel and law enforcement when applicable.

The ideal candidate is deeply technical, possesses strong business acumen, and understands how technology is involved in day-to-day operations. The Senior Forensics Analyst demonstrates a track record of leading complex investigations and driving continuous improvement within the forensic and incident response program.

ABM offers a comprehensive benefits package. For information about ABM’s benefits, visit:
Recruiting Flyer - Staff & Mgmt

Education:

• Bachelor’s degree preferred in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related field.

Experience:

• 7+ years of combined experience in cybersecurity, incident response and security operations, with a minimum of 4 years in a dedicated digital forensics role
• Demonstrated expertise with forensic tools including, but not limited to, Access Data Forensic Toolkit (FTK), Magnet Axiom, EnCase, X-Ways, REMnux and SIFT
• Proven ability to perform malware analysis, reverse engineering and examination of obfuscated code
• Strong understanding of attacker tactics, techniques and procedures (TTPs) and the MITRE ATT&CK framework
• Experience with log and data aggregation systems (SIEM platforms such as Microsoft Sentinel, Splunk or similar)
• Proficient scripting ability with one or more languages including Python, Power Shell, JavaScript and Bash
• Clear understanding of evidence preservation, chain of custody and legal requirements for digital evidence
• Strong understanding of the NIST Cybersecurity Framework and associated controls
• Administration experience with network and host configurations, endpoint detection and response (EDR), application security, encryption and cloud services
• Advanced understanding of TCP, UDP, HTTP, IP and other network protocols
• Strong verbal and written communication skills with the ability to explain complex technical topics to business leaders
• Excellent judgment and the ability to make quick decisions when working with complex situations
• Demonstrated ability to lead investigations and mentor junior team members
• Self-starter who can work efficiently both independently and with teams
• High degree of integrity, trustworthiness and confidence; represents the company and its management team with the highest level of professionalism

Certifications:

One or more of the following required: GCFE, GCFA, GREM, GCIH, EnCE or CISSP

Education:

• Master’s degree in information assurance, Cybersecurity, Computer Science, Digital Forensics or a related technical field.

Experience:

• 10+ years of combined experience in cybersecurity, incident response, security operations and digital forensics
• Holistic experience across Computer Network Defense, Cryptography, Identity Management, Information Assurance, Malware Analysis and Infrastructure Design
• Experience leading forensic investigations in hybrid and multi-cloud environments (Azure, AWS, GCP)
• Experience identifying, investigating and responding to complex attacks including advanced persistent threats (APTs)
• Demonstrated experience developing forensic processes, playbooks and program maturity initiatives
• Experience with vulnerability management platforms (Tenable, Rapid7, Qualys)
• Ability to utilize and develop scripts that interact with APIs, automate forensic…