Senior DFIR Analyst – Incident Response Lead

About the role

Group-IB is seeking a Senior DFIR Analyst to lead end‑to‑end incident response engagements for clients across Latin America. You will act as the primary technical liaison, guiding investigations from initial scoping through executive briefings and delivering clear, actionable findings.

Key responsibilities

• Lead client‑facing incident response engagements across endpoint, cloud and network environments.
• Serve as the main technical point of contact, coordinating analysts and ensuring timely delivery.
• Make informed decisions with incomplete data, balancing depth of analysis with client urgency.
• Collaborate with a global practice, hand cases across time zones and contribute tooling and findings back to the team.
• Conduct host forensics on Windows/Active Directory, Unix/Linux and macOS systems.
• Investigate cloud and identity compromises in AWS, Azure/Entra and GCP.
• Perform log analysis, threat hunting and malware triage to support investigations.
• Document attacker tools, tactics and procedures to improve future response.
• Produce written reports and verbal briefings in Spanish and English for technical teams, executives, regulators and legal counsel.

Required profile

• Proven experience leading incident response and digital forensics engagements.
• Strong analytical mindset with ability to act on limited information.
• Excellent communication skills in both Spanish and English.
• Comfort working in a distributed, global team environment.

Required skills

• Windows and Active Directory forensics
• Unix/Linux forensics
• macOS forensics
• Amazon Web Services (AWS)
• Microsoft Azure / Entra
• Google Cloud Platform (GCP)
• Log analysis
• Threat hunting
• Malware triage