Lead Security Analyst (Digital Forensics and Incident Response))
Stamford, CTAll locationsStamford, CTIrving, TX Hybrid
Salary not listedJobFig found this opening at its original source and checks that it remains available.
About the role
This is a new role within Gartner's Security Operations team, focused on Digital Forensics and Incident Response (DFIR). As a Lead Analyst, you will be responsible for leading complex investigations, conducting forensic analysis across enterprise systems, and helping Gartner respond to, contain, and recover from cybersecurity incidents. You will serve as a technical leader for investigations involving advanced threats, insider risk, legal and regulatory matters, and high-priority security events. This role requires deep expertise in digital forensics, evidence handling, incident response, and threat analysis, combined with the ability to communicate findings clearly to technical and non-technical audiences. As part of a highly collaborative team, you will work closely with teams such as Security Operations, Threat Intelligence, Legal, Human Resources, Privacy, Compliance and Engineering to protect Gartner's people, data and intellectual property. Gartner believes in fair and equitable pay. Please note that actual salaries may vary within the range, or be above or below the range, based on factors including, but not limited to, education, training, experience, professional achievement, business need, and location.
What you'll bring
- Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, related fields, or equivalent practical experience.
- 7+ years of experience in digital forensics and incident response, with at least 2 years in a senior or lead capacity, including experience leading complex incident response investigations.
- Experience using Python, PowerShell or other similar scripting languages to automate and accelerate forensic workflows and evidence processing.
- Hands on experience with digital forensics tools and platforms, including (but not limited to): Magnet Forensics, EnCase, Volatility, MemProcFS, FTK, KAPE, UAC, Autopsy/Sleuth Kit, Velociraptor or equivalent platforms.
- Experience with cloud forensics in AWS and Azure environments, including investigations involving cloud-native services and Kubernetes/containerized workloads.
- Strong hands-on experience in Windows, macOS, Linux, and memory forensics.
- Strong proficiency with endpoint detection and response (EDR/XDR), SIEM and SOAR platforms (Splunk, Microsoft Sentinel, Athena, etc.), network forensics (Zscaler, ExtraHop, Wireshark), and log analysis.
- Experience performing malware analysis, reverse engineering, and threat hunting.
- Excellent written and verbal communication skills, including the ability to produce clear forensic reports as well as explain technical concepts to non-technical stakeholders
- Experience running insider threat or HR/Legal driven investigations
- Strong command of evidence handling, chain of custody, and forensically sound acquisition, including live response and remote collection.
- Calm and decisive under pressure, with the ability to manage multiple priorities simultaneously.