DFIR Analyst (Digital Forensics & Incident Response)
Summary
Cybersecurity DFIR analyst who triages security alerts, leads incident containment and recovery, and runs digital forensics across disk, memory, network, and endpoint artifacts using SIEM, EDR, and threat-intel tooling. Requires 3+ years in security operations and at least two relevant certifications.
Salary: ₱35.000 – ₱50.000 per month
About the role
DFIR Analyst (Digital Forensics & Incident Response) responsible for triaging and investigating security events, performing incident analysis and digital forensic investigations, and contributing to cybersecurity operations.
Key responsibilities
Triage and investigate security events and alerts
Perform incident analysis, containment, eradication, and recovery activities
Conduct digital forensic investigations on disk, memory, network, and endpoint artifacts
Analyze logs, threats, malware behavior, and attacker activities
Correlate findings across SIEM, EDR, cloud, and threat intelligence platforms
Identify Indicators of Compromise (IOCs) and attacker TTPs
Create incident reports, technical findings, and recommendations
Participate in cybersecurity exercises, incident simulations, and knowledge-sharing activities
Contribute to operational reporting and incident metrics
About you
Minimum 3 years of experience in Digital Forensics, Incident Response, SOC, Cybersecurity Operations, or related roles
Hands-on experience in Incident Investigation
Hands-on experience in Malware Analysis
Hands-on experience in Log Analysis
Hands-on experience in Evidence Handling
Hands-on experience in Threat Detection & Response
Familiarity with SIEM, EDR, forensic imaging, and investigation tools
Strong understanding of NIST Incident Response Lifecycle
Strong understanding of MITRE ATT&CK
Strong understanding of Network Security
Strong understanding of Operating Systems & Endpoint Security
Strong technical writing and incident documentation skills
Possess at least two (2) of the following certifications (or equivalent): CCDL1, CCDL2, Security+, CySA+, eCIH