Senior Engineer Network Forensics & Incident Response

Description

The company's network security team is hiring a senior engineer for its Security Defense organization. The Defense teams own the security lifecycle and effectiveness across the Core, Edge, and Access networks and every system and network function within the N&T group.

You will be the technical lead for network digital forensics and incident response (DFIR) across the Network Security Defense portfolio. You will run investigations and lead response during major security events, and work across the Defense organization to improve network visibility and forensic readiness. Strong candidates also bring incident orchestration skills, hands-on work with modern forensic suites, and proven automation and scripting experience that speeds up forensic capture and detection.

Responsibilities

• Lead response during major security incidents, directing containment, root-cause analysis, threat eradication, and network recovery.
• Collect, preserve, and analyze forensic evidence across mixed network infrastructure, including edge routers, switches, cloud environments, and specialized network functions.
• Examine full packet captures (PCAP), NetFlow/IPFIX, firewall logs, and router and switch artifacts to follow adversary lateral movement and data exfiltration.
• Analyze volatile memory dumps, live network state, process execution artifacts, and compromised systems during active intrusions to find malware, persistence mechanisms, and lateral movement.
• Build, write, and maintain custom YARA rules for memory analysis, file carving, binary inspection, and ongoing endpoint and network artifact matching.
• Hunt proactively through advanced persistent threat (APT) TTPs, pull out indicators of compromise (IOCs), and turn findings into usable detections.
• Write scripts that automate artifact collection, evidence ingestion, and triage to shorten response times.
• Create and refine DFIR playbooks and runbooks for high-impact incidents such as state-sponsored intrusions, ransomware, supply chain compromises, and DDoS events.
• Write thorough forensic reports covering attack timelines, root cause, evidence, impact, and technical remediation recommendations.

Requirements

• A bachelor's degree, or four or more years of relevant work experience.
• Four or more years of relevant experience in digital forensics, network security engineering, or incident response, gained through work, military service, specialized training, or a mix of these.
• Deep experience with SIEM and data analysis platforms such as Splunk and ELK.
• Strong proficiency with forensic acquisition and analysis suites such as EnCase, FTK, Volatility, X-Ways, SANS SIFT, and KAPE.
• Expert knowledge of core network protocols (TCP/IP, BGP, OSPF, DNS, TLS, HTTP/S) and telemetry formats (NetFlow, IPFIX, syslog).
• Even better: industry DFIR certifications such as GIAC Network Forensic Analyst (GNFA), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH), or Certified Computer Examiner (CCE).
• Even better: forensics experience on 4G/5G wireless network functions, carrier-grade IP networks, or virtualization platforms such as Kubernetes, OpenStack, and KVM.
• Even better: scripting and automation in Python, PowerShell, or Bash for forensic artifact collection and processing.
• Even better: knowledge of the MITRE ATT&CK framework and of bringing enterprise threat intelligence into forensic workflows.
• Even better: clear written, interpersonal, and verbal communication, including summarizing complex forensic findings for technical and non-technical audiences.
• Even better: hands-on technical leadership during major cyber security incidents.
• Even better: experience working with engineers, business owners, and executives.
• Even better: strong leadership and mentoring skills, including guiding and developing teams.
• Even better: a proven record of delivering results under high-pressure security incidents.

Conditions

This role can be based in any US-based company hub location.

The role is hybrid: you will have a defined work location that includes working from home and at least three days per week in the office, set by your manager. You are responsible for following the hybrid work policies.

The position is scheduled for 40 hours per week.

If you believe this posting omits information required by Virginia's wage or salary range transparency law, you can report it through the contact details listed for the company's pay transparency reporting.

Benefits

• Health and wellness options including medical, dental, and vision coverage, short- and long-term disability, basic and supplemental life insurance, AD&D insurance, identity theft protection, pet insurance, and group home and auto insurance.
• A matched 401(k) savings plan, up to 8 company-paid holidays and up to 6 personal days per year, paid parental leave, adoption assistance, and tuition assistance.
• Newly hired employees receive up to 15 days of vacation per year, which increases with service.
• Depending on the role, possible premium pay such as overtime, shift differential, holiday pay, and allowances.
• Part-time employees may be eligible for some of these benefits, depending on their individual circumstances.
• Pay depends on location and on the skills and experience you confirm. The role is incentive-based, with potential to earn more. Part-time pay is adjusted to match hours.
• The annual full-time salary range for the listed location(s) is $101,000.00 - $194,000.00.