EY is a global leader in professional services, dedicated to building a better working world. We foster a culture of continuous learning and growth, empowering our people to develop their careers and achieve their full potential. Our Forensic & Integrity Services team helps organizations safeguard their reputation and navigate complex challenges.

This role focuses on Digital Forensics and Incident Response (DFIR), investigating security incidents and analyzing digital evidence. You'll play a crucial part in containing and remediating cyber security threats, requiring hands-on experience with investigations, triage, evidence collection, and detailed documentation of complex incidents.

As a DFIR Analyst, you will investigate security incidents by understanding system details and business impact. You'll identify and review evidence from various sources, including logs, endpoint data, and security platforms. Your responsibilities include validating suspicious activity, reconstructing attack paths, and supporting containment actions. You'll acquire and preserve forensic images and data, meticulously analyzing artifacts like event logs, registry entries, and malware indicators. Preparation of comprehensive investigation reports detailing findings, impact, and recommendations is also key.

We are seeking candidates with 2-4 years of experience in Digital Forensic and Incident Response investigations. A Bachelor of Technology in Computer Science or equivalent experience is required. Proficiency with forensic tools such as Autopsy, Sleuth Kit, FTK Imager, EnCase, Cellebrite, and Volatility is essential. Familiarity with EDR platforms (Microsoft Defender XDR, CrowdStrike, SentinelOne) and SIEM/log analytics tools (Splunk, Elastic, Sentinel) is also necessary. Strong knowledge of Windows/Linux internals, Active Directory, and cloud platforms (AWS, Azure) is vital. Basic scripting skills in PowerShell or Python, along with excellent analytical and communication abilities, are expected.