Specialist, Cybersecurity (Digital Forensics)

Description

The company is a Fortune 100 business with nearly $70 billion in annual sales, and its technology team wants people who can help it adopt new tools that produce real business results.

Customers come first, so the team looks for people who take service seriously and care about giving customers excellent care.

This cybersecurity role focuses on digital forensics: investigating incidents, analyzing digital evidence and supporting incident response.

The ideal person is strong in forensic tools and data analysis and understands operating systems, cloud platforms and forensic processes well.

The team works in an agile, collaborative setting. Cyber operations covers incident response, cyber strategy, defense optimization, scanning and exploitation, and related enterprise security services.

Responsibilities

• Lead and carry out forensic investigations into breaches, malware, unauthorized access, intellectual property theft and other security incidents.
• Gather, preserve and examine digital evidence from endpoints, servers, cloud environments and mobile devices, keeping chain of custody intact and following legal and regulatory rules.
• Image and analyze Windows, Linux, macOS and mobile devices using industry-standard tools and methods.
• Write Python or PowerShell scripts that automate evidence collection, data parsing and artifact extraction.
• Review logs, network traffic and large datasets to rebuild timelines and identify root causes.
• Write detailed forensic reports and present findings to technical and non-technical audiences, including legal, HR and management.
• Help build and refine forensic processes and playbooks.
• Respond to cyber incidents using PICERL: preparation, identification, containment, eradication, recovery and lessons learned.
• Improve cyber detection and alerting to prevent ongoing threats.
• Apply secure software and systems engineering practices throughout the delivery lifecycle.
• Build automation and orchestration to enrich and handle cyber security events.
• Support vulnerability management and proactively find weaknesses in the environment.
• Help plan and run activities that strengthen detection and prevention, including purple teaming, threat hunting and red teaming, across the MITRE ATT&CK framework.
• Identify critical log sources and system events used to create and tune detections.
• Track the cyber threat landscape and share relevant intelligence to protect members and the environment.
• Take on other duties as assigned.

Requirements

• Proficiency in Python or PowerShell for automation and data analysis.
• Experience with forensic imaging and analysis tools.
• Solid understanding of file systems and of Windows, Linux and macOS.
• Ability to analyze and interpret large datasets.
• Experience with digital evidence collection and preservation, and with forensic methodologies.
• Familiarity with incident response procedures and how they fit into forensic workflows.
• Knowledge of regulatory and compliance requirements for data security, privacy and digital evidence.
• At least 3 years of experience in technology, such as operating systems, networking, desktop support, application development, endpoint security, database management or information security.
• Hands-on experience configuring and using Windows and Linux/Unix operating systems.
• Action-oriented, with the ability to make decisions and recommendations, build partnerships, understand business processes and set priorities.
• Solid communication skills.
• Exceptions to these requirements must be approved by the hiring manager's leader and the HR business partner.
• Consistently demonstrates the company's values.
• Preferred: understanding of networking concepts and protocols.
• Preferred: exposure to cloud platforms such as AWS, Azure and GCP.
• Preferred: certifications such as GIAC GCFA, GCIH, CEH, EnCE, MCFE or similar. Other listed certifications include CISSP, CCNA, GSTRT, GSE, CCSP, AWS Certified Cloud Practitioner and AZ500.
• Preferred: strong written and verbal communication for reporting and presenting findings.
• Undergraduate study in cyber security, management information systems, engineering, math, computer science or data analytics, or comparable experience and education, is strongly preferred.
• A plus: graduate study in cyber security, computer science or a related field.
• A plus: knowledge of the insurance or financial services industry.
• Leadership skills, competencies and other experience may take precedence over these criteria.

Conditions

Hybrid schedule: work in the Columbus, Ohio office 2 days per week.

Exempt position, not eligible for overtime.

Reports to a Manager, Risk Leader or higher.

The national salary range is $95,500.00 to $177,500.00, and the expected starting range is $95,500.00 to $143,500.00.

Starting pay within the range depends on skills, education, credentials, experience, the scope and location of the role, local labor costs and other factors.

Pay follows a geographic-specific salary structure. For part-time work, pay is prorated by hours compared with a full-time schedule.

The listed duties are the main essential functions, though individuals may perform a somewhat different mix of duties.

The company is an equal opportunity employer that prohibits discrimination and harassment.

Benefits

• Medical, dental and vision coverage, life insurance, and short and long term disability coverage.
• New hires receive a minimum of 18 days of paid time off each full calendar year, pro-rated quarterly from the hire date.
• Nine paid holidays, 8 hours of Lifetime paid time off and 8 hours of Unity Day paid time off.
• 401(k) with company match and a company-paid pension plan.
• Business casual attire and other benefits.