DFIR Analyst – Digital Forensics s Incident Response

Experience: 2–3 Years | Full time | Cybersecurity / DFIR

Job Summary
We are seeking a motivated and hands-on DFIR Analyst with 2–3 years of experience in digital forensics, incident response, security operations, or related cybersecurity functions. The candidate will investigate security incidents across Windows, Linux, and macOS environments, perform endpoint and log analysis, correlate forensic evidence with SIEM/EDR telemetry, identify indicators of compromise, and support containment and remediation activities.

Key Responsibilities
Perform triage, investigation, and analysis of cybersecurity incidents across Windows, Linux, and macOS endpoints and servers.
Analyze Windows artifacts including EVTX, Registry, Prefetch, AmCache, ShimCache, SRUM, Scheduled Tasks, Services, Autoruns, browser artifacts, PowerShell logs, and other relevant artifacts.
Analyze Linux artifacts including system/authentication logs, shell history, cron jobs, systemd services, SSH activity, user accounts, processes, network configuration,



and persistence mechanisms.
Analyze macOS artifacts including Unified Logs, plist files, LaunchAgents, LaunchDaemons, login items, browser artifacts, user activity, and APFS-related evidence.
Perform basic memory forensics and volatile-data analysis using tools such as Volatility or equivalent tooling.
Investigate suspicious files, scripts, processes, persistence mechanisms, and malware behavior; perform basic static and dynamic malwaretriage.
Extract, validate, and correlate IOCs including hashes, domains, URLs, IP addresses, filenames, registry keys, user accounts, and process indicators.
Build investigation timelines and reconstruct attack activity by correlating endpoint, network, authentication, and security telemetry.
Support threat hunting activities using SIEM, EDR, threat intelligence, forensic artifacts, and MITRE ATTCCK-based hypotheses.
Contribute to the development and improvement of DFIR

📌 DFIR Analyst (India)
🏢 Innefu Labs
📍 India