高级德语数字取证与事件响应（DFIR）顾问
German Senior Digital Forensics and Incident Response (DFIR) Consultant
CYPFER 是一家领先的应急网络安全组织，帮助客户在遭受网络攻击后迅速有效地恢复业务。作为勒索软件事件事后修复和网络攻击应急响应领域的全球市场领导者，我们持续提供超出行业标准的解决方案，用于处理网络勒索和勒索软件事件。我们的团队与知名全球保险公司、领先的律师事务所和财富1000强企业合作。
我们正在寻找一名双语高级数字取证与事件响应（DFIR）顾问加入我们的团队。在此职位中，您将领导复杂的调查工作，跨各种平台进行取证分析，并制定战略事件响应计划。流利的英语和德语是与我们多元化的客户群体有效合作的必要条件。如果您对网络安全充满热情，并能在动态环境中茁壮成长，我们期待您的加入。
核心职责：
- 代表 CYPFER 参与事件响应任务，与各类保险公司合作伙伴、法律顾问、事件响应小组、客户高管和技术团队进行互动。
- 使用标准工具和方法从受影响的系统中收集取证数据和镜像。
- 执行 Windows/Unix/Linux 取证和初步评估，以及网络取证以评估入侵和调查。
- 精通恶意软件分析工具和方法。
- 应用缓解策略和概念来修复已识别的威胁。
- 分析初步收集的数据/证据，查找入侵指标（IoCs）和潜在恶意活动。
- 审查主机系统和设备的日志，以识别可疑活动。
- 从物理和虚拟端点及服务器中收集取证磁盘和内存镜像。
- 对物理系统、虚拟机和网络数据进行取证分析。
- 理解事件生命周期和网络杀伤链。
- 熟悉威胁行为者使用的数据泄露技术。
- 关联事件并构建事件时间线。
- 保持对新兴威胁和漏洞的最新了解。
- 使用各种技术分析文件以查找 IoCs。
- 根据调查期间收集的 IoCs 进行有限的威胁研究。
- 理解用于隐藏恶意命令和流量的混淆技术，以及威胁行为者采用的横向移动策略。
- 在团队内部及跨团队协作并共享信息，有效沟通
查看英文原文
CYPFER is a leading first-responder cybersecurity organization enabling clients to swiftly and effectively return to business following a cyber-attack. As a global market leader in ransomware post-breach remediation and cyber-attack first response, we consistently deliver results that exceed market standards for handling cyber-extortion and ransomware events. Our team collaborates with prominent global insurance carriers, leading law firms, and Fortune 1000 businesses.
We're seeking a Bilingual Senior Digital Forensics and Incident Response (DFIR) Consultant to join our team. In this role, you'll lead complex investigations, conduct forensic analyses across various platforms, and develop strategic incident response plans. Fluency in both English and German is essential to effectively collaborate with our diverse client base. If you're passionate about cybersecurity and thrive in a dynamic environment, we'd love to hear from you.
Core Responsibilities:
- Engage on behalf of CYPFER in incident response tasks, interacting with various insurance partners, legal counsel, incident response units, client executives, and technical teams.
- Utilize standard tools and methodologies to collect forensic artifacts and images from affected systems.
- Perform Windows/Unix/Linux forensics and triage, and network forensics to assess compromise and investigations.
- Skilled in malware analysis tools and methodologies.
- Apply mitigation strategies and concepts to remediate identified threats.
- Analyze triage collections/artifacts for indicators of compromise (IoCs) and potentially malicious activity.
- Review logs from host systems and appliances to identify suspicious activities.
- Collect forensic disk and memory images from physical and virtual endpoints and servers.
- Perform forensic analysis of physical systems, virtual machines, and network data.
- Understanding of an incident lifecycle and cyber-kill-chain.
- Familiarity with exfiltration techniques used by threat actors.
- Correlate events and build timelines of events.
- Maintain current knowledge on emerging threats and vulnerabilities.
- Analyze files for IOCs using various techniques.
- Conduct limited threat research based on IOCs collected during investigations.
- Understand obfuscation techniques used to conceal malicious commands and traffic, and lateral movement strategies employed by threat actors.
- Collaborate and share information within and across teams and communicate effectively with client managers and executives.
- Write detailed reports and summarize findings clearly and concisely.
- Participate in a rotating on-call schedule; ability to work on weekends and outside normal business hours as needed.
- This role is remote but requires the ability to travel on short notice to a client site up to 50%. Must maintain flexibility to travel frequently within 24-48 hours' notice for deployments typically 1-2 weeks in duration.
Technical Requirements:
- 5+ years of experience in digital forensics, incident response, or a similar role.
- Strong knowledge of Windows and Unix/Linux operating systems.
- Expertise in threat hunting, network forensics, and EDR / EPP technologies.
- Skilled in forensic acquisition and analysis of physical and virtual systems.
- Advanced understanding of networking, routing, and firewall operations.
- Working knowledge of storage technologies such as RAID, NAS, SAN, Fiber Channel, iSCSI, and NFS.
- Ability to analyze and interpret logs from various sources.
- Familiarity with SIEM and SOAR solutions.
- Ability to perform threat research and analyze current threats.
- Understanding of business email compromise (BEC) cases and investigation techniques.
Business Responsibilities:
- Fully Bilingual (English/German)
- Maintain current knowledge of information security, incident response techniques, emerging threats, and tools.
- Work independently and produce high-quality deliverables with minimal supervision.
- Exhibit strong customer service and consulting skills.
- Adhere to client and internal policies, procedures, and security practices.
- Maintain detailed notes and draft updates and reports as required.
- Remain calm, composed, and articulate in tough customer situations.
- Exhibit excellent relationship management and communication skills.
Preferred Skills:
- Experience with e-discovery tools and methodologies.
- Proficiency in collecting and analyzing data from mobile devices/cell phones.
- Industry certifications such as MCFE, ENCE, ACE, GCFA, GCIH, GNFA, GCFE or similar are a plus.
Cypfer is an equal opportunity employer. If you need accommodation during the interview process or beyond, please let us know. We celebrate our inclusive work environment and welcome applicants from all backgrounds and perspectives.
We thank you for your interest in joining the Cypfer team! While we welcome all applicants, only those selected for an interview will be contacted.
Originally posted on Himalayas