German Senior Digital Forensics and Incident Response (DFIR) Consultant

About this role

CYPFER is a leading first-responder cybersecurity organization enabling clients to swiftly and effectively return to business following a cyber-attack. As a global market leader in ransomware post-breach remediation and cyber-attack first response, we consistently deliver results that exceed market standards for handling cyber-extortion and ransomware events. Our team collaborates with prominent global insurance carriers, leading law firms, and Fortune 1000 businesses.

We're seeking a Bilingual Senior Digital Forensics and Incident Response (DFIR) Consultant to join our team. In this role, you'll lead complex investigations, conduct forensic analyses across various platforms, and develop strategic incident response plans. Fluency in both English and German is essential to effectively collaborate with our diverse client base. If you're passionate about cybersecurity and thrive in a dynamic environment, we'd love to hear from you.

Core Responsibilities: Engage on behalf of CYPFER in incident response tasks, interacting with various insurance partners, legal counsel, incident response units, client executives, and technical teams. Utilize standard tools and methodologies to collect forensic artifacts and images from affected systems. Perform Windows/Unix/Linux forensics and triage, and network forensics to assess compromise and investigations. Skilled in malware analysis tools and methodologies.

Apply mitigation strategies and concepts to remediate identified threats. Analyze triage collections/artifacts for indicators of compromise (IoCs) and potentially malicious activity. Review logs from host systems and appliances to identify suspicious activities. Collect forensic disk and memory images from physical and virtual endpoints and servers. Perform forensic analysis of physical systems, virtual machines, and network data.

Understanding of an incident lifecycle and cyber-kill-chain. Familiarity with exfiltration techniques used by threat actors. Correlate events and build timelines of events. Maintain current knowledge on emerging threats and vulnerabilities. Analyze files for IOCs using various techniques. Conduct limited threat research based on IOCs collected during investigations. Understand obfuscation techniques used to conceal malicious commands and traffic, and lateral movement strategies employed by threat actors.